A shared administrator login feels efficient when there are only two people. Both can get in, nothing is blocked, and there is no permission model to discuss.
Then a third person joins, someone leaves, or a CI job needs access. The shortcut starts carrying decisions it was never designed to express.
Start with named people and a clear scope
Basic self-hosted teams, invitations and fixed project roles are included in Hakopod Free. Use them to give people access to the work they share, instead of passing around installation-wide credentials.
Projects and environments give that access context. A person working on a development application does not automatically need the same authority over production. Pick the smallest useful scope, then check that the person can complete the intended workflow.
Permission names are only the beginning. Deployment access is powerful because deployed code can read the secrets bound to its service. Keeping a secret value out of the dashboard does not make it inaccessible to someone who can replace the workload using it.
Give automation its own credentials
A CI pipeline should use a scoped machine credential, not a browser session borrowed from an administrator. That makes its permissions easier to review and its access easier to replace when the workflow changes.
Keep the token out of repository files and command output. When a deployment request fails, diagnose the response without printing the credential into a shared log. The convenience of a debugging statement can outlast the problem it was added to solve.
When a teammate leaves or a pipeline is retired, remove the corresponding access deliberately. A common password makes that process harder because every user and script becomes part of the same rotation.
Know which controls exist today
Free collaboration covers teams, invitations and fixed project roles. Actor audit history requires a signed Pro entitlement. Custom roles and organization MFA enforcement remain planned.
Those are different capabilities, and the website should keep them separate. A paid audit feature does not mean that basic collaboration needs a paid plan. A planned access control should not be described as available just because it appears in a product direction document.
For a small team, a useful first exercise is simple: list who needs to deploy, who needs to inspect, and which environment each person needs. Compare that list with the actual grants. Repeat the exercise when the team changes.
The security and access guide explains the current boundaries and the responsibilities that remain with the installation operator.