is there a way to automatically grant team access to new stacks? we’re in the middle of migrating some older infrastructure and creating a fair number of stacks. it’s a tedious manual process, and half the time we forget to do it before someone says “hey i need access to this stack.”

No. We have had that problem for years.

cc @sticky-translator-61903 Definitely something we want to improve. How would you want this to work? We did add a teams flag to the CLI which doesn’t fully automate it, but can be a useful helper https://www.pulumi.com/blog/stack-init-teams-flag/

I didn't know about that feature. Does that grand read, write or admin access?

We do have an issue open for specifying permission level and we hope to get to it soon: https://github.com/pulumi/pulumi/issues/14326 Teams are an enterprise feature so the

--teams

flag does require that your org be on an enterprise plan.

For non-enterprise plans, there's no way to add a 2nd owner, is that right? All users are admins on all stacks?

All RBAC related features are a part of the enterprise plan https://www.pulumi.com/pricing/