OAuth Workspace Authorization

The OAuth connection lets a person sign into LaunchDarkly with their existing company account rather than a separate password, and grants Beam access scoped to what that account can already see. A Beam agent reads a request to connect a new workspace, checks it against the approved list of projects that account is permitted to touch, and completes the authorization in LaunchDarkly. It records which workspace was connected and by whom for later reference. A request to authorize access to a project outside that account's normal permissions is routed to a human to confirm first.

Member Role Assignment

LaunchDarkly assigns each connected member a role, such as reader, writer, or admin, that controls what they can change within a project. A Beam agent reads a role change request from a connected HR or ticketing system, applies the approved mapping between job function and LaunchDarkly role, and updates the member's access accordingly. It notes the change against the member's account so the assignment can be traced later. Requests to grant admin level access, or to change a role for a sensitive production project, are routed to a human before anything is applied.

Environment-Level Permissions

LaunchDarkly separates flags by environment, such as staging and production, and lets access be limited to one without the other. A Beam agent reads an approved request to extend a member's access to an additional environment, such as adding production once a trial period in staging is complete, and applies the change in LaunchDarkly. It records the new scope against the member's account so the change is easy to review later. Any request to grant production access without a completed staging period is routed to a human instead of being applied automatically.