Access grants
Control which members and teams can reach which connections and connection groups.
An access grant gives a grantee (a user or a team) access to a target (a connection or connection group) in one workspace.
Who can reach a connection
- Organization owners and admins can see and open every connection in the workspace. Grants don't apply to them.
- Everyone else can see and open only the connections granted to them — directly, through one of their teams, or through a connection group that contains the connection.
Default posture is closed. A member with no grants sees no connections. A connection they aren't granted doesn't appear in lists, and opening it fails as if it didn't exist.
Relay checks grants each time a tunnel is opened, so a revoked grant stops new connections immediately.
Creating a grant
Choose a grantee (user or team) and a target (connection or connection group) in the dashboard under Grants, or from the CLI:
relay grants create --grantee-type user --grantee alice@example.com \
--target-type connection --target prod-db
relay grants list
relay grants delete <grant-id>Creating grants requires the org.access_grants.create permission; revoking
requires org.access_grants.delete. The grants table shows each grantee,
target, who granted it, and when — and lets you revoke.
Expiry
Grants created in the dashboard or the CLI last until revoked. A grant created
through the API can carry an expiry (expires_at, which must be in the future);
once it passes, the grant stops applying without any cleanup.
Plans
Access grants require the Team plan or higher. The free plan has a single member — the owner — who already reaches every connection, so there is nothing to grant.