Roles and permissions

💡 Roles are how you delegate safely. Promote a trusted teammate to Admin to share the load, or create a custom role that grants exactly one capability and nothing more.

What's in this article?

The four built-in roles
What each role can do
Custom roles
Changing someone's role
FAQs

The four built-in roles

Owner. Full control of the workspace. Only the Owner can transfer ownership or delete the workspace. There is one Owner at a time.
Admin. Manages people, plan, credits, security, branding, and integrations. Cannot transfer ownership or delete the workspace.
Member. Uses the product day to day. Manages their own personal settings, like their own spending limit, but not workspace-wide settings.
Viewer. Read-only access to most areas.

What each role can do

Area	Owner	Admin	Member	Viewer
Members & roles	✅	✅	—	—
Teams	✅	✅	—	—
Plan & billing	✅	✅	—	—
Workspace credits & limits	✅	✅	Own limit only	—
Security, SSO & domains	✅	✅	—	—
Audit log	✅	✅	—	—
Branding & profile	✅	✅	View	View
API keys & webhooks	✅	✅	Own only	View
Connectors	✅	✅	✅	View
Transfer ownership	✅	—	—	—
Delete workspace	✅	—	—	—

🧠 Admins run the workspace, but only the Owner can give it away or delete it.

FAQs

Can there be more than one Admin? Yes. You can have as many Admins as you need. There's only ever one Owner.

What's the safest role for someone who only needs to look at data? Viewer. It's read-only across most of the workspace.

Can I limit someone to just one capability? Yes. Create a custom role with only that permission and assign it.

I want a teammate to manage billing but nothing else. Build a custom role scoped to plan and credits, and assign it to them instead of full Admin.