# Teams

Organization teams group members and grant them a shared role on
repositories. Teams nest: a team's path is its ancestors' handles joined with
dots (`eng.web`), and that path is also its URL segment.

## Find or create a team

- Lists every team you can see in the organization, indented under its parent.
  Each row shows the display name and visibility (`visible` or `secret`).
  A personal organization has no teams page and redirects to its overview.
- Owners and admins see **New team**: name, slug (derived from the name until
  you edit it), visibility, and an optional parent team. A visible team cannot
  be placed under a secret team, so secret parents disappear from the parent
  list while visibility is `visible`.
- Owners and admins also get a trash button per row. The confirmation names
  the team and, when it has descendants, how many child teams go with it.

## Manage a team

The header shows the team's name, visibility and path. Members and
Repositories tabs are always present. Management controls appear only when the
current credential has authority for that operation. An unknown path shows
"Team not found."

### Members

- Lists team members with avatar and handle and their team role (Reader,
  Triager, Writer, Maintainer). Credentials with owner-level team membership
  authority (normally organization owners) change the role in the row and it
  saves at once; everyone else sees the role as text.
- **Add member** requires the same membership authority and searches the
  organization members who are not yet on the team; pick one, choose a role,
  and add. Nothing is sent until a member is picked.
- The trash button removes a member after confirmation.

### Repositories

- Lists the organization repositories this team has access to with the granted
  role (Read, Triage, Write, Maintain, Admin). Organization owners, admins, and
  team maintainers with repository authority change the role in the row and it
  saves at once. Repository-specific administration is still checked by the server.
- **Add repository** searches the organization repositories the team
  has no grant on yet, plus the team role to grant.
- The trash button revokes the grant after confirmation.

### Rulesets

- Lists the team's branch and tag protection rulesets; **New ruleset** and each
  row's name open the editor at `/orgs/<org>/teams/<path>/rulesets/<id>` (or
  `/new`), the same [editor repositories use](https://git.cafe/docs/repositories/repository-rulesets.md).
  Cancel and Save return to this tab.
- A team ruleset applies to the repositories the team currently holds a grant
  on (the Repositories tab) and appears in their **Effective rules** with the
  `team` scope; revoking the grant withdraws the rules.
- The Rulesets tab is available to organization owners, admins, and team
  maintainers with team metadata authority.
  Changing protection can reject a push already in progress on an affected
  repository; review the new rules before retrying it.

### Settings

One form: rename the team, change its visibility, pick a new parent (or
none), then **Save**. The team cannot move under one of its own descendants.
When the parent changes, the team's path changes too, so the page moves to
the new URL. Organization owners, admins, and team maintainers with metadata
authority can use this form. Reparenting also requires authority over the
destination team; moving to no parent requires organization management authority.
Maintaining the source team alone does not permit every destination. Deleting a
team happens from the team list.

## Limits

- If someone else changes the team, member or repository access while you are
  editing, your change is rejected and the page refreshes. Review the current
  values before retrying.
- Team trees, team members, repository grants, and the organization member and
  repository candidate sets load all available pages before replacing the
  displayed set. Large sets can therefore take several requests to appear.
- Team descriptions are not available yet.
