Administration Roles and permissions
Roles and permissions
A member holds exactly one role. A role is a fixed set of permissions. Roles shows all six side by side, with a count of the members who hold each.
Who can do it
Every member can read Roles. You give a role to someone on Members, by invitation, by changing their role, or through single sign-on. You can only give a role whose permissions you hold yourself, so an Admin cannot make an Owner.
The six roles
| Role | In the console's words |
|---|---|
| Owner | Everything, including workspace settings. |
| Admin | Everything except workspace settings and sending artifacts to a judge. |
| Analyst | Triages alerts and issues; reads interaction content. |
| Policy author | Writes and enables policies; configures engines. |
| Fleet operator | Manages machines and connections. |
| Compliance reader | Sees alerts, policies, engines and machines. Changes nothing. |
What each role allows
| Permission | Owner | Admin | Analyst | Policy author | Fleet operator | Compliance reader |
|---|---|---|---|---|---|---|
| View alerts | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Triage alerts | ✓ | ✓ | ✓ | — | — | — |
| View machines | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Read interaction content | ✓ | ✓ | ✓ | — | — | — |
| Reveal held values | ✓ | ✓ | — | — | — | — |
| View policies | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| Edit policies | ✓ | ✓ | — | ✓ | — | — |
| Enable policies | ✓ | ✓ | — | ✓ | — | — |
| View engines | ✓ | ✓ | ✓ | ✓ | — | ✓ |
| View engine runs | ✓ | ✓ | ✓ | — | — | — |
| Configure engines | ✓ | ✓ | — | ✓ | — | — |
| Send artifacts to AI judge | ✓ | — | — | — | — | — |
| Manage the fleet | ✓ | ✓ | — | — | ✓ | — |
| View connections | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Manage connections | ✓ | ✓ | — | — | ✓ | — |
| Manage members | ✓ | ✓ | — | — | — | — |
| Manage API keys | ✓ | ✓ | — | — | — | — |
| Manage workspace settings | ✓ | — | — | — | — | — |
| View the audit log | ✓ | ✓ | — | — | — | ✓ |
Two rows are worth knowing. Reveal held values opens the original text kept under the Restricted redaction mode, one block at a time, and the console writes an audit entry before it shows it. Read interaction content is separate from View machines: a Fleet operator sees machines without reading prompts.
Custom role is shown on the page but is not available yet; it is marked Soon.
Where each setting needs which permission
| Page | To read | To change |
|---|---|---|
| General, Plan and licence | Any member | Manage workspace settings |
| Members | Any member | Manage members |
| Single sign-on | Any member | Manage workspace settings |
| API keys | Manage API keys | Manage API keys |
| Interaction logging, Retention | Any member | Manage workspace settings |
| Log streaming | Manage workspace settings or View the audit log | Manage workspace settings |
| Audit log | View the audit log | Not editable |
When it goes wrong
- The roles could not be read. Reload the page. If it persists, sign in again.
With the API
Not available with an API key. A key acts as one role, never above the person who created it, and never carries Manage API keys, Manage members or Manage workspace settings. See API keys.