Managing Enclave Members

Enclave membership is primarily managed through Slack — The Kraken watches channel events and keeps membership in sync automatically. This guide covers the full set of member management operations, including the cases where direct CLI use is needed.

Adding Members

Joining a Slack channel does not automatically grant enclave membership. New channel members start as visitors. The enclave owner must explicitly add them.

Via The Kraken (Recommended)

The enclave owner mentions the user in a Kraken command:

@kraken add @alice

The Kraken resolves Alice’s Slack profile email, confirms it matches an OIDC identity, and adds her as a member via enclave_sync. The channel is notified:

alice@company.com has been added as a member of this enclave.

Via CLI

If The Kraken is not available:

tntc enclave sync <enclave-name> --add-member alice@company.com

This requires the caller to be the enclave owner or a platform operator. The added user must have a valid OIDC identity in Keycloak — tntc enclave sync does not create identities.

Removing Members

Members are removed either explicitly by the owner or automatically when they leave the channel. In both cases, tentacles owned by the departing member are automatically transferred to the enclave owner.

Via The Kraken (Recommended)

@kraken remove @alice

The Kraken removes Alice from the enclave. Her tentacles are transferred to the enclave owner. The channel is notified:

alice@company.com has been removed from this enclave. 2 tentacles were transferred to the enclave owner.

Automatic Removal

When a member leaves the Slack channel (member_left_channel event), The Kraken automatically removes them and transfers their tentacles. No action is needed from the owner.

Via CLI

tntc enclave sync <enclave-name> --remove-member alice@company.com

Tentacles owned by the removed member transfer to the enclave owner. The transfer count is included in the response.

Transferring Tentacle Ownership

The enclave owner can reassign ownership of any tentacle to another member. This is useful after a member departs or when responsibilities shift.

Via The Kraken

@kraken transfer the price-monitor tentacle to Bob

Via CLI

tntc enclave chown <enclave-name> <tentacle-name> bob@company.com

Only the enclave owner can transfer tentacle ownership. The new owner must be a registered member of the enclave.

Transferring Enclave Ownership

Enclave ownership follows Slack channel ownership. If the Slack channel owner changes, The Kraken detects it during the next reconciliation cycle and updates the enclave accordingly.

To trigger an immediate reconciliation:

tntc enclave sync <enclave-name>

The new owner inherits superuser control over all tentacles in the enclave. The previous owner becomes a regular member (if they remain in the channel) or loses access (if they left).

Changing Permission Presets

The enclave owner can change who can do what in the enclave at any time.

Via The Kraken

Use the set mode command with a preset name:

@kraken set mode open-read

@kraken set mode private

The Kraken also understands natural language:

@kraken let anyone in this channel see what's running

Via CLI

# Set a named preset on the enclave
tntc permissions set <enclave-name> --mode open-read

# Set a named preset on a specific tentacle
tntc permissions chmod member-read <enclave-name> <tentacle-name>

Available presets: private, member-read, member-edit (default), open-read, open-run.

See Team Collaboration for the full preset reference.

Freezing an Enclave

Freezing pauses cron triggers and prevents new deployments. Running tentacles continue to run until they complete. Freezing is reversible.

Freezing happens automatically when the Slack channel is archived. To freeze manually:

tntc enclave sync <enclave-name> --status frozen

To unfreeze (also happens automatically when the Slack channel is unarchived):

tntc enclave sync <enclave-name> --status active

While frozen:

• Running tentacles complete normally
• Cron triggers are paused (no new scheduled runs)
• New deployments are blocked
• Read operations (status, logs, list) work normally

Deprovisioning an Enclave

Deprovisioning is permanent and irreversible. It stops all tentacles, deletes all exoskeleton resources (Postgres schemas, S3 prefixes), and removes the Kubernetes namespace.

Via The Kraken

@kraken shut down this workspace

The Kraken asks for confirmation before proceeding:

This will stop all automations and delete all data in this workspace. There is no undo.
Are you sure? Reply "yes delete everything" to confirm.

Via CLI

tntc enclave deprovision <enclave-name>

The CLI also requires explicit confirmation (--confirm flag or an interactive prompt).

Caution

Deprovisioning deletes the Kubernetes namespace and all resources within it, including Postgres data and S3 objects scoped to the enclave. Ensure any important data is backed up before proceeding.

Checking Your Role

Any user can check their role in the enclave:

@kraken whoami

The Kraken responds with your role (owner, member, or visitor) and your email.

To see all members:

@kraken members

This lists the owner, all members, and the current access level in plain language.

Auditing Membership

# List all members and owner of an enclave
tntc enclave info <enclave-name>

# List all enclaves you have access to
tntc enclave list

The enclave info output includes:

• Owner email
• Member list with registration timestamps
• Permission preset
• Exoskeleton service status
• Tentacle count and quota usage