Members & access
Everyone who uses Firefight is a member of your workspace. Each member has an access level that decides whether they can change how the workspace is set up, and it stays the same whatever they are doing on any given incident.
How people become members
Section titled “How people become members”Anyone in your Slack workspace who uses Firefight becomes a member automatically. Running a /ff command, being picked as incident lead, or signing in to the web dashboard with Slack is enough. Firefight creates the membership on the spot using the person’s Slack profile.
Only full members of your Slack workspace join this way. Guests of your Slack workspace, and people from another organization who share a channel with you, can’t use Firefight from Slack or sign in with it, and Firefight tells them so when they try. Invite someone by email if they need access without being a full member of your Slack workspace.
Admins can also invite people by email, which works before Slack is connected and for teammates who aren’t in your Slack workspace.
The person who created the workspace, or first connected it to Slack, is its owner. Everyone after that joins as a regular member. Someone who joined by email and later signs in with Slack keeps the same membership, as long as Slack has confirmed their email address.
Invite people by email
Section titled “Invite people by email”- Open Settings → Members and click Invite people.
- Enter one or more email addresses, separated by commas or new lines, up to 20 at a time.
- Click Send invitations.
Each person gets an email with a Join button named after your workspace. It opens a page with the same button, and clicking it signs them in and adds them as a member. If they don’t have a Firefight account yet, joining creates one, and they sign in again later with an email link or Google. The link works once, for 7 days after it was last sent.
Invitations you have sent and that nobody has accepted yet are listed under Pending invitations, with who sent each one and when. Each row’s menu has:
- Resend, which emails a new link and stops the old one working.
- Revoke, which asks first and then stops the link working. You can invite the same person again later.
Inviting someone who already has a pending invitation sends it again. Inviting someone who is already a member is refused. A workspace sends up to 30 invitation emails an hour, resends included. Only owners and admins see Invite people and the row menus. On a Firefight you run yourself without outgoing email, Invite people is greyed out, and hovering it says why.
The members list
Section titled “The members list”Settings → Members shows everyone in your workspace. For each person you see their name, email, and avatar, their access level, and when they joined.
| Access | Meaning |
|---|---|
| Owner | The person who created the workspace, or first connected it to Slack |
| Admin | Can change workspace settings as well as respond to incidents |
| Member | Everyone else who uses Firefight |
Admins and owners can edit the settings screens. Members respond to incidents with the full set of /ff commands, and read the dashboard without being able to reconfigure the workspace. A settings screen a member cannot change shows the same list without the add, edit and reorder controls.
An admin can open a settings screen to a specific member without making them an admin, by granting it under Gateway → Permissions. Grant someone runbooks, and the Runbooks screen gives them the same controls an admin sees, everywhere else stays read-only. Integrations, API keys, AI accounts, Permissions itself, and workspace settings cannot be granted, and stay with admins and owners.
Agents, Permissions and Activity under Gateway, and the Workspace settings page, are visible to admins and owners only. Approvals is visible to everyone, and the sidebar shows how many requests are waiting. Approving or denying one needs the approvals permission, which admins and owners hold, unless a workflow’s Approval step names you. Activity is the workspace’s audit log. Every settings change anyone makes on the dashboard is listed there, alongside what agents and service keys did.
You never need to raise someone’s access to give them a job during an incident. Making a member the Incident Lead leaves their access exactly as it was. See Incident roles.
Removing someone
Section titled “Removing someone”Owners and admins can remove a member from Settings → Members. Open the person’s row menu and choose Remove. Firefight asks first, and names what stops working, such as their personal tokens and the AI agents they connected.
Removing someone takes effect at once:
- They lose access to the workspace and are signed out of any page of it they have open. Their other workspaces are not touched.
- Their personal tokens and the agents they connected over MCP stop working for good.
- Incidents, timelines and history that name them stay as they are.
- Using Firefight in Slack no longer adds them back. Firefight tells them an admin removed them.
You can’t remove yourself, only an owner can remove another owner, and a workspace’s only owner can’t be removed. In those cases Remove is greyed out, and hovering it says why.
Removed people are listed under Removed on the same page, with the date. Choose Add back to give them their access again, with the access level they had. Accepting an email invitation adds them back too. Their old tokens stay revoked, so they create new ones once they are back.
Granting more than an access level allows
Section titled “Granting more than an access level allows”To grant someone reach beyond their access level, without promoting them, use permission sets. They are additive bundles you can grant to a person, an API key, or an AI agent. See Permissions.