# Roles and permissions > Every built-in AI CodeOps role and what it can do: who starts sessions, who approves changes, who edits policies, plus custom roles and how roles are assigned. Source: https://aicodeops.dev/docs/roles-and-permissions · Last updated: 2026-10-18 Everyone in a workspace has one role. The role is a set of permissions, and each permission unlocks one kind of action. This page lists what each built-in role holds. To invite people and change their roles, see [Members and roles](https://aicodeops.dev/docs/members). Roles govern people. What AI sessions may do on their own is set by the [workspace policy](https://aicodeops.dev/docs/policy-engine). ## Built-in roles | Role | In short | | -------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Owner | Full access, including making other owners. | | Admin | Full access except deleting the workspace and transferring ownership. | | Developer | Runs AI sessions and manages projects, agents, schedules, deployments and incidents. Manages own API keys. | | Member | Runs AI sessions and manages deployments, incidents and decision records. Manages own API keys. | | Viewer | Read-only. Can't run sessions or create API keys. | | Security Admin | Policies, the audit log, approvals and finding triage. No billing, secrets or sessions. | | DevOps Admin | Projects, runbooks, schedules, deployments, incidents, MCP servers, agents and notifications. No billing, members or secrets. | | Billing Admin | Billing, budgets and usage. No access to code, secrets or members. | | Secret Manager | Workspace secrets only. | The last four are separation-of-duties roles: each covers one area, so a single compromised admin account can do less. ## Who can do what | Action | Owner | Admin | Developer | Member | Viewer | Security Admin | DevOps Admin | Billing Admin | Secret Manager | | --------------------------------------------- | :---: | :---: | :-------: | :----: | :----: | :------------: | :----------: | :-----------: | :------------: | | Start, cancel and re-run AI sessions | Yes | Yes | Yes | Yes | No | No | Yes | No | No | | Approve or reject changes | Yes | Yes | No | No | No | Yes | No | No | No | | Triage findings | Yes | Yes | Yes | Yes | No | Yes | Yes | No | No | | Manage projects | Yes | Yes | Yes | No | No | No | Yes | No | No | | Manage deployments and incidents | Yes | Yes | Yes | Yes | No | No | Yes | No | No | | Manage custom agents and schedules | Yes | Yes | Yes | No | No | No | Yes | No | No | | Manage MCP servers and notification endpoints | Yes | Yes | No | No | No | No | Yes | No | No | | Add model provider keys and change settings | Yes | Yes | No | No | No | No | No | No | No | | Edit the workspace policy | Yes | Yes | No | No | No | Yes | No | No | No | | Read the audit log | Yes | Yes | No | No | No | Yes | No | No | No | | Create own API keys | Yes | Yes | Yes | Yes | No | No | No | No | No | | See everyone's usage and cost | Yes | Yes | No | No | No | No | Yes | Yes | No | | Manage billing and the cost budget | Yes | Yes | No | No | No | No | No | Yes | No | | Manage workspace secrets | Yes | Yes | No | No | No | No | No | No | Yes | | Invite and remove members | Yes | Yes | No | No | No | No | No | No | No | | Create custom roles | Yes | Yes | No | No | No | No | No | No | No | Every role can see the workspace and its member list, and manage its own two-factor methods and sign-in sessions. Single sign-on is managed by the organization's owners and admins, not by a workspace role. See [Single sign-on](https://aicodeops.dev/docs/sso). ### Approving changes Approvals need the approval-decide permission. A request can also name specific approvers. The person who launched a session can't approve its change while someone else in the workspace can approve; a solo team can approve its own work. Details are in [Approvals and policies](https://aicodeops.dev/docs/approvals-and-policies). ### Running sessions Starting, cancelling, re-running and fixing a finding with AI all need the run-manage permission. A role without it can still open sessions and read their results. ## Custom roles On the Enterprise plan, owners and admins can create roles with exactly the permissions they need. 1. Open **Configure → Settings** and find **Roles & Permissions**. 2. Under **Custom Roles**, choose **Create Role**. 3. Enter a **Role Name** and a **Slug**. 4. Tick the permissions. They are grouped, for example Workspace, Members, API Keys, Models & Providers, Projects & Operations, Governance & Secrets, and Usage & Billing. 5. Choose **Create Role**. Assign it under **Role Assignment** on the same page, or when you invite someone. Changes take effect immediately. - You can't grant a permission you don't hold yourself. - Only an owner can change a role that has administrative permissions: changing settings, deleting the workspace, assigning roles or creating roles. Only an owner can assign such a role. - A role that is still assigned can't be deleted. - **Remove members** lets a custom role remove members, but never an owner or an admin: only an owner removes those. - If the organization leaves the Enterprise plan, custom roles keep only the permissions a Member has. ## Rules for assigning roles - An owner can assign any role. - An admin can assign any role that isn't administrative. - You can't change or remove someone at or above your own level. - A workspace must always keep an owner. Every role change is recorded as `role.changed` in the [audit log](https://aicodeops.dev/docs/audit-logs). ## Two-factor sign-in Owners, admins, the four separation-of-duties roles and any custom role with sensitive permissions, such as managing secrets, policies, members or billing, must set up two-factor sign-in. Developers must on Pro and Enterprise, members on Enterprise, and viewers never. See [Members and roles](https://aicodeops.dev/docs/members). ## Next steps - [Members and roles](https://aicodeops.dev/docs/members) - [Audit logs](https://aicodeops.dev/docs/audit-logs) - [Single sign-on](https://aicodeops.dev/docs/sso) ## Frequently asked questions ### Can a developer approve an AI change? Not with the built-in Developer role. Approving needs the approval-decide permission, which owners, admins and security admins have. A custom role can include it. ### Which roles can start AI sessions? Owners, admins, developers, members and DevOps admins. Viewers, security admins, billing admins and secret managers can't. ### Do roles apply to API keys? Yes. A workspace API key acts as the member who created it, with that member's current role.