> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nova.galaxa.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Zero-Seat Team Management & RBAC

> Why Nova offers unlimited team seats with zero licensing fees, passwordless magic-link invites, and role-based access control.

# Zero-Seat Team Management & RBAC

In the traditional SaaS and BSP landscape, vendors impose artificial "per-seat" licensing taxes—charging between ₹1,500 and ₹3,500 per month for every additional teammate who logs into the dashboard.

This model forces growing merchants into uncomfortable trade-offs: either share insecure master passwords or lock out marketing, support, and warehouse analysts from critical customer and revenue data.

**Galaxa Nova rejects the per-seat tax entirely.**

Nova provides **Zero-Seat Team Management**: unlimited team members on every plan with zero seat fees, zero user caps, and enterprise-grade Role-Based Access Control (RBAC).

***

## The Zero-Seat Philosophy

| Dimension | Legacy Tools (Gallabox, Wati, Intercom) | Galaxa Nova AI |
| :- | :- | :- |
| **Seat Pricing** | ₹1,500 to ₹3,500+ / user / month | **₹0 (Zero)** — Forever free and unlimited |
| **User Limits** | Capped by subscription tier (e.g. 3 or 5 users) | **Unlimited team members** across all tiers |
| **Credential Sharing** | Forced due to seat costs, violating basic security | **Individual accounts** with passwordless magic links |
| **Monetization Focus** | Penalizing merchant team growth | **Aligned with merchant sales and GMV success** |

***

## Role-Based Access Control (RBAC)

To maintain strict operational security without gating collaboration, Nova enforces three distinct permission roles:

| Feature & View | Admin | Analyst | Support |
| :- | :-: | :-: | :-: |
| **Dashboard Metrics & KPIs** | Full Access | Full Access | Full Access |
| **Contacts Directory & GMV** | Full Access | Full Access | Full Access |
| **Live Chat Transcripts** | Full Access | Full Access | Full Access |
| **CSV & JSON Exports** | Full Access | Full Access | No Access |
| **Broadcast Campaigns (Send/Edit)** | Full Access | View Only | No Access |
| **Templates Library** | Full Access | View Only | No Access |
| **Storefront Agent Configuration** | Full Access | No Access | No Access |
| **Developer API Key Generation** | Full Access | No Access (`403`) | No Access (`403`) |
| **Team Member Invitations & Removal** | Full Access | No Access (`403`) | No Access (`403`) |
| **Spend-Cap & Billing Settings** | Full Access | No Access (`403`) | No Access (`403`) |

### Client-Side Gating & Server-Side Enforcement

Security is enforced at both layers:

* **UI Navigation Filtering:** In the dashboard, `App.RBAC.applyRole()` automatically hides administrative navigation tabs (`Settings`, `Deploy`, `Broadcasts`, `Templates`) for non-admin team members. Attempting to navigate directly via URL hash triggers an unauthorized notification and redirects the user back to the main view.
* **HTTP API Middleware:** In `src/dashboard/router.js`, `requireAdminRole` intercepts all write and administrative routes (`POST /api/dashboard/settings`, `POST /api/dashboard/team/invite`, `POST /api/dashboard/developer/keys`, `DELETE /api/dashboard/developer/keys/:id`). Non-admin requests receive an immediate `403 Forbidden`.

***

## Passwordless Magic-Link Invitations

Nova eliminates the vulnerabilities of weak passwords and credential sharing by using passwordless email authentication powered by custom Resend SMTP delivery:

```mermaid theme={null}
flowchart LR
    A["Admin Enters Email & Selects Role"] --> B["Nova Creates Team Membership Invite"]
    B --> C["Resend Dispatches Branded Invitation Email"]
    C --> D["Teammate Clicks Secure 1-Time Magic Link"]
    D --> E["Instant Authentication with Scoped Permissions"]
```

### Inviting a Teammate

1. In the dashboard, navigate to **Settings -> Team Management**.
2. View your current team directory, showing active and pending invitations.
3. Click **Invite Team Member**.
4. Enter the teammate's email address and select their role (`Admin`, `Analyst`, or `Support`).
5. Click **Send Invitation**.
6. The teammate immediately receives a branded invitation email with a secure 1-click login link.

### Member Revocation

Administrators can revoke access for departing team members or contractors with a single click. Revoking a membership immediately invalidates all active sessions and secret tokens associated with that user.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.