gplay team (users + grants + permissions)

Two write surfaces and one offline reference: account-wide membership (team users), per-app access (team grants), and the permission vocabulary (team permissions). Shared conventions are in gplay-cli-usage.

Permission vocabulary (start here)

gplay team permissions --scope app       # offline; account scope by default (team users), app scope for team grants
gplay team permissions --output json     # marks the admin-conferring alias and bundle

Writes take --role <bundle> XOR --permissions <alias,…> (raw CAN_* enums accepted); team users resolves in account scope, team grants in app scope.

Account-wide members