Zero-Seat Team Management & RBAC

Why Nova offers unlimited team seats with zero licensing fees, passwordless magic-link invites, and role-based access control.

Zero-Seat Team Management & RBAC

In the traditional SaaS and BSP landscape, vendors impose artificial “per-seat” licensing taxes—charging between ₹1,500 and ₹3,500 per month for every additional teammate who logs into the dashboard.

This model forces growing merchants into uncomfortable trade-offs: either share insecure master passwords or lock out marketing, support, and warehouse analysts from critical customer and revenue data.

Galaxa Nova rejects the per-seat tax entirely.

Nova provides Zero-Seat Team Management: unlimited team members on every plan with zero seat fees, zero user caps, and enterprise-grade Role-Based Access Control (RBAC).

---

The Zero-Seat Philosophy

Dimension	Legacy Tools (Gallabox, Wati, Intercom)	Galaxa Nova AI
Seat Pricing	₹1,500 to ₹3,500+ / user / month	₹0 (Zero) — Forever free and unlimited
User Limits	Capped by subscription tier (e.g. 3 or 5 users)	Unlimited team members across all tiers
Credential Sharing	Forced due to seat costs, violating basic security	Individual accounts with passwordless magic links
Monetization Focus	Penalizing merchant team growth	Aligned with merchant sales and GMV success

---

Role-Based Access Control (RBAC)

To maintain strict operational security without gating collaboration, Nova enforces three distinct permission roles:

Feature & View	Admin	Analyst	Support
Dashboard Metrics & KPIs	Full Access	Full Access	Full Access
Contacts Directory & GMV	Full Access	Full Access	Full Access
Live Chat Transcripts	Full Access	Full Access	Full Access
CSV & JSON Exports	Full Access	Full Access	No Access
Broadcast Campaigns (Send/Edit)	Full Access	View Only	No Access
Templates Library	Full Access	View Only	No Access
Storefront Agent Configuration	Full Access	No Access	No Access
Developer API Key Generation	Full Access	No Access (403)	No Access (403)
Team Member Invitations & Removal	Full Access	No Access (403)	No Access (403)
Spend-Cap & Billing Settings	Full Access	No Access (403)	No Access (403)

Client-Side Gating & Server-Side Enforcement

Security is enforced at both layers:

• UI Navigation Filtering: In the dashboard, App.RBAC.applyRole() automatically hides administrative navigation tabs (Settings, Deploy, Broadcasts, Templates) for non-admin team members. Attempting to navigate directly via URL hash triggers an unauthorized notification and redirects the user back to the main view.
• HTTP API Middleware: In src/dashboard/router.js, requireAdminRole intercepts all write and administrative routes (POST /api/dashboard/settings, POST /api/dashboard/team/invite, POST /api/dashboard/developer/keys, DELETE /api/dashboard/developer/keys/:id). Non-admin requests receive an immediate 403 Forbidden.

How Roles Are Resolved (fail-closed)

A request’s role is never assumed. Nova resolves it in this order and grants nothing it cannot prove:

1. roles attached to the already-verified identity;
2. the user’s Appwrite Teams membership for their organization (authoritative);
3. the legacy profiles.role grant — used only when Teams answered “no membership yet”, which is the state of merchants provisioned before Teams launched;
4. otherwise nothing → 403.

If the identity provider cannot be reached (timeout, 5xx, missing configuration), the lookup counts as unresolved and grants no privileged access. Before this rule a failed lookup fell through to admin, so an Appwrite blip silently promoted every signed-in session to administrator; that path is closed and pinned by tests (tests/dashboard/rbac_fail_closed.test.js).

---

Passwordless Magic-Link Invitations

Nova eliminates the vulnerabilities of weak passwords and credential sharing by using passwordless email authentication powered by custom Resend SMTP delivery:

Inviting a Teammate

1. In the dashboard, navigate to Settings -> Team Management.
2. View your current team directory, showing active and pending invitations.
3. Click Invite Team Member.
4. Enter the teammate’s email address and select their role (Admin, Analyst, or Support).
5. Click Send Invitation.
6. The teammate immediately receives a branded invitation email with a secure 1-click login link.

What the Dashboard Reports

Nova only shows an invitation as pending when the identity provider actually accepted the dispatch:

• Sent — the membership invite exists and the email is on its way.
• 409 — the address is already a member or already has a pending invite; nothing new is created.
• 502 — the identity provider rejected the request (misconfiguration, SMTP failure, outage). Nothing is recorded, so the team list can never show a teammate who never received an email. Retry once the cause is fixed.
• 409 (no organization) — the signed-in account is not attached to an organization, so there is no team to invite into.

Member Revocation

Today membership removal is performed in the Appwrite Console (Teams → your organization → remove the member). The Nova dashboard does not yet expose a remove-member button, so do not expect one in the team card.

Because every dashboard request resolves identity → team → organization (with a 30-second memo), removing the membership means the next resolution finds no organization and the person loses dashboard access. Already-issued API keys are a separate credential: revoke them explicitly in Settings → Developer API, or they keep working after the person has left the team.