Roles and permissions
The organization and workspace roles, and what each one reaches on the platform.
Each person has one role in the Organization and one role in each Workspace they belong to. The two are independent and add up.
That combination decides what shows up in the sidebar and what the platform accepts when you click save.
Organization roles
- Superadmin: full access. It is the only role that opens Providers, Credentials and Settings › General.
- Admin: runs the organization: workspaces, members, quotas, SuperAgents, MCPs and Integrations. It doesn't reach Providers, Credentials or Settings › General, and doesn't register new MCPs in the registry.
- Auditor: read-only, and only in Workspaces, Members, Quotas, Observability and SuperAgents.
- User: no access to Organization screens. This is the role for people who only use Chat.
The gap between Superadmin and Admin is deliberate: what holds secrets, provider accounts and credentials, stays with a single role.
Workspace roles
- Owner: full access to the workspace, including Integrations, API keys and deleting the workspace.
- Curator: builds and monitors. Creates Collections, Agents, SuperAgents, Workflows, MCPs and Variables, and reads the Dashboard, Conversations, Response feedback, Observability and Quotas.
- Editor: builds only. Same creation power as the Curator, without any of the monitoring and settings screens.
- Auditor: read-only, across most of the workspace.
- User: no access to the administration screens. Chats in Chat.
| Workspace area | Owner | Curator | Editor | Auditor |
|---|---|---|---|---|
| Collections, Agents, SuperAgents, Workflows, MCPs, Variables | Edits | Edits | Edits | Reads |
| Dashboard, Observability, Quotas | Reads | Reads | No access | Reads |
| Conversations, Response feedback | Reads | Reads | No access | Reads |
| Models, Members, General | Edits | No access | No access | Reads |
| Integrations, API keys | Edits | No access | No access | No access |
How the two combine
The platform resolves access to a workspace in this order:
- If you are a member of the workspace, your workspace role applies.
- If you aren't, but you are a Superadmin, Admin or Auditor of the organization, your organization role applies.
- If neither applies, the workspace doesn't open.
That is why an organization Admin can enter a workspace they were never added to, while an Editor from another workspace can't.
The sidebar hides what your role doesn't allow, but the real decision is made by the backend: every service rechecks the permission on every call. Typing the URL of a hidden page doesn't give you access to it.
When access isn't what you expected
- You see the workspace but can't edit anything: you got in through your organization role, not as a member. Ask to be added to the workspace.
- You are an Admin and can't open Providers or Credentials: this is by design, and can't be solved per workspace. Those two require Superadmin.
- You are a Curator and don't see Models or Members: also by design. Those two stay with the Owner.
- The Workspace area is disabled: you don't belong to any workspace in that organization.
Next steps
- Understand what belongs to each level in Organizations and Workspaces.
- Your role in the organization shows up in the user menu, under Settings, next to its name.