Join a machine

A developer is part of your organization in two steps: their account joins (an invitation), and each machine they code on joins (a join command run in zn-gate).

1. Invite people

In the dashboard, open your organization's workspace, then Members. Enter an email and a role and send the invitation. The invitation link works for 7 days; owners and admins can revoke it before it is used.

Pending invitations count as seats in use. If every seat is taken, the owner adds seats before the invitation can be accepted.

2. Connect each machine

1. In Members → Installs, create a join command. It works for as many machines as the organization has seats and expires after 7 days.

2. The developer runs it on their machine:

   zn team join <token>

   zn-gate asks for confirmation in a window outside the coding agent, so an agent cannot join a machine to an organization on its own. If you did not just run the command yourself, choose Deny.

3. From then on zn-gate downloads the organization's policy, verifies its signature and applies it, and uploads the audit trail in the background.

When it joins, zn-gate stores the organization, the API address and the organization's public signing key in ~/.zn/team.json, and the install token in the system keychain, never in plain text. The pinned key is how each machine checks that a policy really comes from your organization.

The Team client ships with zn-gate 1.7 (beta). Machines on older versions keep working with their local configuration.

Everyday commands

A machine belongs to one organization at a time. To move it to another one, run zn team leave first.

Remove a machine or a person

• Revoke an install in Members → Installs. That machine stops uploading and keeps applying its cached policy until it expires; then it falls back to strict mode (see Offline mode).
• Remove a member in Members. Their seat is freed and their installs stop receiving the policy.