Adding and removing people

The instinct is to send a teammate the credentials folder. Resist it. Every copy is a permanent liability you cannot audit, and it turns a routine departure into a full five-key rotation.

Add someone without handing over any keys

1. Give them access to the GitHub repository. They can now run leas build --cloud, and the workflow injects the secrets at runtime — they never see a credential.
2. Invite them to your Apple team with the Developer role, so they can build and debug locally on their own device without any ability to ship.
3. Invite them to Play Console with view-only or track-limited permissions matching their job.

Someone with only this access can do everything day-to-day work requires. Reserve the actual credential files for whoever must debug the pipeline itself.

Remove someone

1. Remove them from the GitHub repository or organization, and from your Apple and Play teams.
2. If they only ever held those roles, you are finished.
3. If they ever held a copy of the credential files, run the full rotation in section 8. There is no middle position here — bearer credentials cannot be un-shared.