Permission matrix
| Action | Owner | Admin | Member | Viewer |
|---|---|---|---|---|
| Workspace | ||||
| Edit workspace name / slug | ✓ | ✓ | — | — |
| Delete workspace | ✓ | — | — | — |
| Transfer ownership | ✓ | — | — | — |
| Members | ||||
| Invite member | ✓ | ✓ | — | — |
| Remove member | ✓ | ✓ | — | — |
| Change role (any role) | ✓ | non-owners | — | — |
| Billing | ||||
| View invoices | ✓ | — | — | — |
| Change plan | ✓ | — | — | — |
| Update payment method | ✓ | — | — | — |
| Projects | ||||
| Create project | ✓ | ✓ | ✓ | — |
| Edit any project | ✓ | ✓ | own + assigned | — |
| Delete project | ✓ | ✓ | own only | — |
| View project (read-only) | ✓ | ✓ | ✓ | ✓ |
| Integrations | ||||
| Add / remove integration | ✓ | ✓ | — | — |
| View integration credentials | — | — | — | — |
| API keys | ||||
| Create API key | ✓ | ✓ | — | — |
| Revoke API key | ✓ | ✓ | — | — |
| Audit log | ||||
| View audit log | ✓ | ✓ | — | — |
| Export audit log | ✓ | ✓ | — | — |
Notes
- Integration credentials are never visible, even to owners. They’re stored encrypted and accessed only by the runtime.
- Owners cannot be demoted by admins. An owner must demote themselves (and there must be at least one other owner).
- Role changes are audit-logged — who changed whose role and when.
Related
Roles
Role overview.
Audit logs
History of permission changes.
SSO
Auto-provisioning + roles.