Administer Hermetiq projects and access
Manage projects, users, roles, machine credentials, and project integrations, and understand deployment-controlled retention.
Project-scoped access
Hermetiq access is scoped to projects. Confirm the active project before changing settings, inviting a user, downloading a machine credential, or investigating build data. A user may have different roles in different projects.
Project roles
Can manage project settings, users, roles, invitations, and project credentials in addition to using project data and build services.
Can read project, BEP, and cache data; publish BEP and cache data; and use the project’s remote-execution client scope. A Builder cannot administer project settings or membership.
Can read project, BEP, and cache data. The current Viewer scope also permits use of the project’s remote-execution client, but does not permit publishing BEP or cache data or changing project configuration.
Grant the least-privileged role that supports the person or automation’s job. Machine credentials have a separate artifact and rotation lifecycle, but their scopes derive from the associated member role; manage them as secrets and review their role before issuing or rotating them.
Invite and manage users
- Open Users for the intended project.
- As a project admin, invite the person using the identifier supported by the deployment and assign the initial role.
- Confirm pending invitations and remove stale or unintended invitations.
- After the user joins, review the assigned project role and change it if their responsibilities change.
Choose the default project
Users should select the project they intend to inspect in the dashboard. In customer-managed deployments, where the Default Project setting is available, an admin can designate the project automatically selected for users who have not chosen one. Only one project can be the deployment default.
MCP project scope comes from the authenticated account, selected host, and server configuration. Agents must use the project-selection workflow exposed by that server and must not invent an unsupported project override.
Review MCP setup →Protect machine credentials
The credential helper generated or supplied for a project can contain sensitive machine-to-machine credentials. Treat the helper and any extracted certificate, private key, client ID, or client secret as production secrets.
- Do not commit the helper or generated credentials. Add the local path to
.gitignore. - Restrict file permissions and make the helper executable only where required.
- Store CI copies in the CI platform’s secret manager and expose them only to the jobs that need the project.
- Keep development, CI, and production project credentials separate where those environments have different access boundaries.
- Never paste credentials, tokens, private keys, or helper contents into support requests, logs, or documentation.
Hermetiq Cloud Quickstart can provide the project’s helper download. In a customer-managed deployment, obtain the helper through the deployment administrator’s documented provisioning path.
Rotate or revoke credentials
A project admin can reset a project member’s machine credentials. Depending on the configured authentication path, this may rotate that member’s mTLS certificate, machine-to-machine OAuth client, or both.
- Identify every local and CI environment using the current credential.
- Schedule the change because resetting the selected member’s credential invalidates their existing material and can interrupt ingestion, cache, or remote execution.
- Reset the required credential for that member in Users, then have the member obtain the replacement from the project’s Quickstart or administrator.
- Update secret stores and runners, run a new build, and verify ingestion and any cache or RBE access used by that build.
- Remove superseded local copies and investigate any unexpected use of the old credential.
Control settings and understand retention
Project Settings is an administrative surface for browser or Grafana endpoints, invocation-log storage, output processing, MCP access, BEP forwarding, CAS, Bytestream, and action or cache integrations. Its Data Retention value is read-only: the deployment operator configures the backend retention window, and a project admin cannot change it from the dashboard.
- Record the owner and review date for every enabled integration.
- Ask the deployment operator to apply and document retention policies for each system of record, including the Hermetiq backend, object storage, and telemetry backends.
- Test configuration changes with a new invocation and confirm the intended product surface before considering the change complete.
- Keep secrets in the deployment’s secret manager and redact them from screenshots, support requests, and audit notes.