how does environment RBAC work by default? I see that I can grant a team access to an environment, but I am currently not in a team and still have access. is it just Team RBAC + the creator of the environment always has accesss?

Yes, what you stated is correct. The creator of the environment always has access, and access is otherwise granted via Team RBAC.

ty!