Roles and permissions

Every built-in AI CodeOps role and what it can do: who starts sessions, who approves changes, who edits policies, plus custom roles and how roles are assigned.

View as Markdown Open in ChatGPT Open in Claude

Everyone in a workspace has one role. The role is a set of permissions, and each permission unlocks one kind of action. This page lists what each built-in role holds. To invite people and change their roles, see Members and roles.

Roles govern people. What AI sessions may do on their own is set by the workspace policy.

Built-in roles

Role	In short
Owner	Full access, including making other owners.
Admin	Full access except deleting the workspace and transferring ownership.
Developer	Runs AI sessions and manages projects, agents, schedules, deployments and incidents. Manages own API keys.
Member	Runs AI sessions and manages deployments, incidents and decision records. Manages own API keys.
Viewer	Read-only. Can't run sessions or create API keys.
Security Admin	Policies, the audit log, approvals and finding triage. No billing, secrets or sessions.
DevOps Admin	Projects, runbooks, schedules, deployments, incidents, MCP servers, agents and notifications. No billing, members or secrets.
Billing Admin	Billing, budgets and usage. No access to code, secrets or members.
Secret Manager	Workspace secrets only.

The last four are separation-of-duties roles: each covers one area, so a single compromised admin account can do less.

Who can do what

Action	Owner	Admin	Developer	Member	Viewer	Security Admin	DevOps Admin	Billing Admin	Secret Manager
Start, cancel and re-run AI sessions	Yes	Yes	Yes	Yes	No	No	Yes	No	No
Approve or reject changes	Yes	Yes	No	No	No	Yes	No	No	No
Triage findings	Yes	Yes	Yes	Yes	No	Yes	Yes	No	No
Manage projects	Yes	Yes	Yes	No	No	No	Yes	No	No
Manage deployments and incidents	Yes	Yes	Yes	Yes	No	No	Yes	No	No
Manage custom agents and schedules	Yes	Yes	Yes	No	No	No	Yes	No	No
Manage MCP servers and notification endpoints	Yes	Yes	No	No	No	No	Yes	No	No
Add model provider keys and change settings	Yes	Yes	No	No	No	No	No	No	No
Edit the workspace policy	Yes	Yes	No	No	No	Yes	No	No	No
Read the audit log	Yes	Yes	No	No	No	Yes	No	No	No
Create own API keys	Yes	Yes	Yes	Yes	No	No	No	No	No
See everyone's usage and cost	Yes	Yes	No	No	No	No	Yes	Yes	No
Manage billing and the cost budget	Yes	Yes	No	No	No	No	No	Yes	No
Manage workspace secrets	Yes	Yes	No	No	No	No	No	No	Yes
Invite and remove members	Yes	Yes	No	No	No	No	No	No	No
Create custom roles	Yes	Yes	No	No	No	No	No	No	No

Every role can see the workspace and its member list, and manage its own two-factor methods and sign-in sessions.

Single sign-on is managed by the organization's owners and admins, not by a workspace role. See Single sign-on.

Approving changes

Approvals need the approval-decide permission. A request can also name specific approvers. The person who launched a session can't approve its change while someone else in the workspace can approve; a solo team can approve its own work. Details are in Approvals and policies.

Running sessions

Starting, cancelling, re-running and fixing a finding with AI all need the run-manage permission. A role without it can still open sessions and read their results.

Custom roles

On the Enterprise plan, owners and admins can create roles with exactly the permissions they need.

Open Configure → Settings and find Roles & Permissions.
Under Custom Roles, choose Create Role.
Enter a Role Name and a Slug.
Tick the permissions. They are grouped, for example Workspace, Members, API Keys, Models & Providers, Projects & Operations, Governance & Secrets, and Usage & Billing.
Choose Create Role.

Assign it under Role Assignment on the same page, or when you invite someone. Changes take effect immediately.

You can't grant a permission you don't hold yourself.
Only an owner can change a role that has administrative permissions: changing settings, deleting the workspace, assigning roles or creating roles. Only an owner can assign such a role.
A role that is still assigned can't be deleted.
Remove members lets a custom role remove members, but never an owner or an admin: only an owner removes those.
If the organization leaves the Enterprise plan, custom roles keep only the permissions a Member has.

Rules for assigning roles

An owner can assign any role.
An admin can assign any role that isn't administrative.
You can't change or remove someone at or above your own level.
A workspace must always keep an owner.

Every role change is recorded as role.changed in the audit log.

Owners, admins, the four separation-of-duties roles and any custom role with sensitive permissions, such as managing secrets, policies, members or billing, must set up two-factor sign-in. Developers must on Pro and Enterprise, members on Enterprise, and viewers never. See Members and roles.

Next steps

Frequently asked questions

Can a developer approve an AI change?

Not with the built-in Developer role. Approving needs the approval-decide permission, which owners, admins and security admins have. A custom role can include it.

Which roles can start AI sessions?

Owners, admins, developers, members and DevOps admins. Viewers, security admins, billing admins and secret managers can't.

Do roles apply to API keys?

Yes. A workspace API key acts as the member who created it, with that member's current role.

Was this page helpful?