Administrators manage access to namespaces via users and groups. One admin is created on initial startup, the storageos user. As you are already logged in as storageos, you can perform any action within the system, including creating users (pick a password when prompted):

storageos user create --role user devUser

assigning them to groups:

storageos user update --groups dev,test devUser

and viewing all users:

storageos user ls

Users with the user role can only access namespaces granted to them, and change their own password.

Admins can grant access to namespaces to users with simple Attribute-Based Access Controls called policies.

Create a policy to allow the dev group to access the restricted namespace:

storageos policy create --group dev --namespace restricted storageos policy ls

Since devUser is in the dev group, you can login as devUser:

storageos login [[HOST_IP]]

and create and list volumes in restricted:

storageos volume create --namespace restricted myvol storageos volume ls --namespace restricted

Now, as the admin user again, remove devUser from the dev group:

storageos -u storageos -p storageos user update --remove-groups dev devUser storageos -u storageos -p storageos user ls

Note that you can also run individual commands as a specific user by passing their username and password as flags.

Now devUser should no longer be able to create volumes in restricted:

storageos volume create --namespace restricted shouldFail