Roles
Permissions of Owners, Admins, Editors and Viewers, and how roles are capped per environment.
A role determines what a user can do in a project. Every user has a role in each project they are linked to. Roles are ranked Viewer < Editor < Admin < Owner; a higher role has every permission of the roles below it.
Four roles
Section titled “Four roles”| Role | Assigned to | Permissions |
|---|---|---|
| Owner | Owners of the organization. Not assigned per project. | Everything an Admin can do, in every project. In addition: open Organization admin; create, edit and delete user accounts; reset passwords; create and delete projects. |
| Admin | Assigned to a member in a project. | Everything an Editor can do. In addition: environments (including entering restricted ones), add/edit data sources, members, groups, action permissions, audit log. Delete actions. |
| Editor | Assigned to a member in a project. | Everything a Viewer can do. In addition: create/edit actions, views, schedules, variables and secrets; see SQL and data source config. See the Overview page. |
| Viewer | Assigned to a member in a project. | Run actions they are granted, open views, see their own runs. |
Points to note:
- The Owner is the owner of the organization and is automatically an owner of every project without being linked. An organization can have several owners. The interface has no way to promote a user to owner.
- Editors can see data sources but cannot add or change them. Editors can see the list, the config (without passwords), tables and columns, test the saved connection and pick a data source when writing an action. Adding, editing or deleting a data source and saving connections requires the Admin role.
- Viewers never see SQL, data sources, the audit log or the Access page. They only see Run action, Screens and Jobs (their own jobs).
- A role does not by itself grant permission to run every action. An action in
restrictedmode can only be run by the members and groups it is granted to; this rule also applies to owners and admins. See Access control.
A per-feature table is available in the Permissions matrix.
Assigning roles
Section titled “Assigning roles”- Owners create accounts and can link a person to a project with a role directly from the user’s detail page. See Organization and users.
- A project’s Admins add members, change roles and remove members under Administer > Access.
When a role is changed, the confirmation dialog lists the permissions the person gains and loses. Demoting someone from Admin to a lower role can remove their access to restricted environments they were not granted separately. In that case, schedules running as that person in those environments are turned off and their unfinished jobs are cancelled.
Role caps per environment
Section titled “Role caps per environment”In a restricted environment (only granted people can enter), each access grant carries a Maximum role: viewer or editor. The person’s role in that environment is the lower of their project role and the highest maximum role they were granted (directly or through a group).
| Maximum role | In that environment, the grantee can |
|---|---|
viewer | Run actions and see only their own runs. |
editor | Everything viewer can do, plus: variables and secrets, connections, everyone’s runs, view preview, schedules. |
Example: a project Editor is granted access to prod with maximum role viewer. In prod, that person can run the actions they are granted but cannot read variables, secrets or connections, and sees only their own runs. In dev (an open environment), the person is still an Editor.
- The cap only lowers a role. It never raises it above the project role.
- Owners and Admins are never capped. They always enter every environment with their full role.
- The cap does not block running actions. Run permission is still decided by the action’s permissions.
- In an open environment, the cap does not apply; everyone uses their project role.
- When the role in the selected environment is not sufficient to open a page, the interface shows “In
prod, this page needs the Editor role or higher”. Select another environment in the top bar or contact an admin.
Granting environment access is described in Environments.