Give each person their own access

The team service uses individual member tokens and checks role and project access on the server. Its roles include owner, administrator, operator and viewer. Give each person the minimum access needed for their work, and test that access with their own account. Sharing one administrator token prevents clear revocation and makes responsibility difficult to establish.

Separate access from a running session

Permission to use a profile does not mean two Macs should run it simultaneously. A lease records the current holder. The application renews that lease while it remains active and coordinates closing the runtime before normal release. This distinction allows a member to retain project access while a colleague temporarily owns an individual profile session.

Be precise about what is shared

Team profile configuration is shared through the service. This is not automatic synchronization of all browser state between Macs. Local cookies, website databases and in-memory pages do not become a complete transferable session merely because the profile appears in a team list. Orbit provides a separate, explicit workflow for selected cookie transfer.

Revocation must avoid overlap

Removing a member's access stops future authorized operations. It must also account for a browser that was already running. The server retains the original lease deadline where necessary instead of immediately granting a conflicting session to someone else. A temporary wait is preferable to pretending that an unreachable client has already stopped.

Run a small access review first

Create a noncritical project and try the intended operator and viewer workflows. Check listing, opening, editing, renewal and revocation separately. Record who owns recovery and offboarding. OWASP's authorization guidance emphasizes server-side checks and least privilege; a hidden button alone is not an access-control boundary.