---
title: "Teams"
description: "Learn how Neroli Teams share repository policy, Cloud setup, billing, and selected automation runs while ordinary agent sessions remain private."
---

A Team is a policy and payment layer for selected private GitHub repositories.
It is not a second checkout or a separate mode you enter. Open the repository as
usual; Neroli recognizes its stable GitHub identity and applies Team policy.

## Roles and permissions

| Action | Owner | Admin | Member |
| --- | --- | --- | --- |
| Use Team repositories and configuration | Yes | Yes | Yes |
| Invite Members | Yes | Yes | No |
| Invite or manage Admins | Yes | No | No |
| Add repositories and edit shared setup | Yes | Yes | No |
| Connect Team provider credentials | Yes | Yes | No |
| View usage | Yes | Yes | No |
| Change payment or Cloud allocation | Yes | No | No |
| Change out-of-Team Cloud coverage | Yes | Yes | No |
| Transfer ownership or delete the Team | Yes | No | No |

A Team always needs an Owner. The last Owner must transfer ownership before
leaving. If an external membership change leaves no Owner, Owner-only billing
and security changes stay frozen until an Admin explicitly claims ownership.
Invitations expire after seven days. An accepted person becomes a member only
after payment for the seat succeeds; failed payments remain visible as pending
and do not grant Team access.

## Repositories and Cloud environment

Owners and Admins select private repositories from the Team's GitHub connection.
A repository can belong to only one Team. Members do not need to install the
GitHub App separately to use repositories already selected for that Team.

The Team Cloud environment controls setup commands, compute tier, network
policy, environment variables, and repository secrets. Owners and Admins edit
it; Members consume it. Removing a repository deletes its Team Cloud sessions
but leaves local worktrees, personal Cloud sessions, and the repository itself
untouched. A person's earlier personal environment remains separate.

## Credentials

For each provider, every member chooses **Team credential** or **My credential**.
Owners and Admins can connect, replace, or remove the Team credential. Credential
contents are never revealed to members.

Neroli never silently switches away from the selected source. If the selected
Team credential is missing or invalid, the Cloud start stops with a route back
to Team Settings. If a member selected their own credential, they must configure
it under Personal Settings. A Mac-local login is not copied to Cloud.

## Session privacy

Ordinary sessions always belong to their creator and stay private, even in a
Team repository. Membership, ownership, and administrator status do not grant
access to another person's ordinary session, transcript, terminal, or changes.

The one narrow exception is a Cloud session created by a shared Team automation.
Authorized members can open that run while it remains in Cloud. Only one device
can hold an interactive Codex connection at a time; another viewer sees who has
it open and may explicitly take over. Merely viewing does not claim the session.

Moving an automation run to a Mac stops its Cloud session and creates a private
local continuation for the person who moved it. The frozen run remains in Team
history, but later local messages and changes do not flow back to the Team.

## Team automations

An automation created for a Team repository has a named owner. Current members
share its definition, enabled state, schedule, memory, and run history. Manual
runs belong to the person who pressed Run; scheduled runs belong to the
automation owner.

Visibility is **Team** by default. The automation owner or a Team Owner/Admin can
choose **Only me**. In that mode, other members cannot list or run the
automation, see its run history, open its sessions, or receive its events.
Owners and Admins can still see that the definition exists and may disable,
archive, or transfer it, but cannot inspect its private runs or sessions.

Completed Cloud runs remain in the Automations section until each person
dismisses them. Dismissal is personal and does not delete shared history. A
paused Cloud run stays in Cloud and resumes there; opening it never pulls it to
a teammate's Mac. The owner cannot leave while they own enabled shared
automations, so transfer or disable them first.

## Billing and coverage

Each Team has its own subscription, accepted-member seats, recurring Cloud-hour
allocation, concurrency, refill settings, and usage. Team billing does not hide
or prevent an optional Personal plan.

Who pays follows these rules:

1. A repository selected for a Team always bills that Team.
2. Outside Team repositories, a live Personal plan pays first.
3. Otherwise, one eligible Team may cover the work according to its setting:
   **Off**, **Owners and Admins** (the default), or **Everyone**.
4. If more than one Team could pay, Neroli asks once and remembers the choice.

Coverage changes only billing. It never shares a repository, session, or
automation. A remembered payer is checked again at every start, so disabled
coverage or a lapsed plan cannot keep paying silently.

Increasing Cloud allocation takes effect immediately with prorated billing.
Decreases take effect at the next billing boundary. Cancelling keeps Team
sessions resumable for the displayed retention period; reactivating during that
period restores access. Deleting the Team is immediate and permanent.

## Leaving, removal, and deletion

- Leaving or being removed deletes only that person's Team-backed Cloud
  sessions. Their Personal Cloud sessions, local sessions, repositories, and
  worktrees remain.
- Removing a repository deletes Team Cloud sessions for that repository, but
  does not delete the GitHub repository or local work.
- Deleting a Team deletes all Team Cloud sessions and Team configuration.
- Destructive actions show the affected active and retained session counts
  before confirmation.

Next: read [Cloud](/cloud) for session handoff and [Automations](/automations)
for schedules, local catch-up, and Workspace Commands.