---
name: pollyglot/gplay-team
source: https://app.decimal.ai/s/pollyglot-gplay-team@1/SKILL.md
source_sha256: cf0c9f599a59
---

# gplay team (users + grants + permissions)

Two write surfaces and one offline reference: **account-wide** membership
(`team users`), **per-app** access (`team grants`), and the **permission
vocabulary** (`team permissions`). Shared conventions (auth, output, exit
codes) are in `gplay-cli-usage`.

## Permission vocabulary (start here)

```bash
gplay team permissions                 # account-scope aliases + role bundles
gplay team permissions --scope app     # the per-app enum family
gplay team permissions --output json   # marks the admin-conferring alias/bundle
```

`team permissions` is **offline** (no API call, no credential) and is the
single source of truth the write commands resolve `--role` / `--permissions`
through (ADR-0016). It lists the curated **aliases** and the frozen **role
bundles**: `viewer`, `reviewer`, `tester-manager`, `release-manager`, `admin`.
Writes express permissions in friendly form — **`--role <bundle>` XOR
`--permissions <alias,…>`** — and any raw `CAN_*` enum is also accepted.
`--scope account` resolves the account-wide `_GLOBAL` family (for `team
users`); `--scope app` resolves the bare per-app family (for `team grants`).

## Account-wide members

```bash
gplay team users list
gplay team users add alice@example.com --role release-manager
gplay team users set bob@example.com --permissions CAN_REPLY_TO_REVIEWS_GLOBAL
gplay team users remove carol@example.com
```

`add` invites a member (`users.create`); `set` **declaratively replaces** a
member's account-wide permissions; `remove` off-boards them. These are the
routine tier — CI-scriptable, no confirmation gate — **except** conferring
admin: `--role admin` (or a permission set including the all-permissions enum)
requires the named **`--grant-admin`** flag. Handing out full control is never
silent (ADR-0017).

> There is intentionally **no `team users view`** — the Play API has no
> `users.get`, only `users.list`. Use `team users list` (a client-side
> `team users view <email>` is a separate, still-parked proposal).

## Per-app access grants

```bash
gplay team grants list
gplay team grants set alice@example.com --package com.example.app --role reviewer
gplay team grants remove alice@example.com --package com.example.app
```

`grants set` is an **upsert** scoped to one app: gplay reads the member's
current grants, then creates the grant if absent or updates it if present.
`grants remove` removes access to one app while **keeping** the membership.
Admin-conferring grants likewise require `--grant-admin` (exit `3` if missing).

## Agent-resolvable safety gates

The write commands are designed so an agent can discover a gate **before**
hitting it: `--dry-run` rehearses with no write, and with `--output json` it
emits a **`requires`** array naming the safety flags the live write needs (and,
for grants, the resolved create/update verb plus the permission diff). Read
`requires`, add the named flags, re-run.

## Developer account addressing

Commands act on the active Account's developer id by default; override it with
`--developer-id <id>` (it beats env and the project-local pin) per ADR-0015.
Confirm flags with `gplay team <group> <command> --help`.