Access control (rolling out, beta). One Share panel on Actions, scripts, connections, endpoint tags, hunts and queries, with four levels (View, Use, Edit, Manage) and the Approve, Publish and Respond abilities. Group people into Teams, see everything a member can do from the Members list, and answer "why can they?" with Access check, which replaces Access inspector. Roles: alongside Owner, Admin and Member, use the Analyst, Responder and Detection engineer templates or make custom roles; give a team access across the org; turn old overrides into teams; and optionally limit approval of runs to people given Approve. API keys (personal and service, scoped, always expiring, secret shown once) and an Access log of every access change. Organizations get these screens as they roll out; until then the previous Access screens stay as they are. See Access control.