Organizations and workspaces
Roles and permissions
Organization roles (owner, admin, billing, member) and workspace roles (admin, editor, viewer), with a table of what each can do. Owners and admins are admins of every workspace.
Reference2 min readUpdated 1 November 2026
You have a role in each organization you're in, and a role in each of its workspaces you can open. The organization role decides what you can do with people, workspaces and money; the workspace role decides what you can do with the agents and workflows inside.
Organization roles
| Role | What they can do |
|---|---|
| Owner | Everything, including the organization itself: its name, members and invitations, workspaces and their limits, billing and usage, the audit log, handing it to another member and deleting it. One per organization. An admin of every workspace |
| Admin | Members and invitations, workspaces and their limits, billing and usage, the audit log. An admin of every workspace |
| Billing | Billing and usage, and the monthly credit limits of workspaces. Sees the list of members and of workspaces, but opens a workspace only when added to it |
| Member | Only the workspaces they're added to, with the role they were given there. Sees the list of members and the workspaces they can open |
Owners and admins are admins of every workspace in the organization without being added to it. A workspace's Members page lists them as Admin · organization owner or organization admin and doesn't let you change them there.
Workspace roles
| Viewer | Editor | Admin | |
|---|---|---|---|
| Open the workspace and read everything in it | Yes | Yes | Yes |
| Build and change agents, workflows, knowledge, datasets, evaluators, alerts and connections | No | Yes | Yes |
| Chat in the Playground and the test chats | No | Yes | Yes |
| Promote into environments that aren't protected (Staging by default) | No | Yes | Yes |
| Promote into protected environments (Production by default) and roll them back | No | No | Yes |
| Add, edit, reorder and remove environments | No | No | Yes |
| Add and remove workspace members and change their roles | No | No | Yes |
| Rename the workspace and change its description | No | No | Yes |
| Set the workspace's monthly credit limit | No | No | Only with an organization role of owner, admin or billing |
| Archive the workspace and restore it | No | No | Only organization owners and admins |
A viewer sees a bar across the app, "You can view this workspace. Ask a workspace admin for edit access.", and anything that would change the workspace is refused with the code WORKSPACE_READ_ONLY.
Where roles are set
- Organization roles: Settings → Organization → Members, in the Role column, by owners and admins. The owner's role can't be changed there; the owner hands the organization over with Make owner. See Transfer ownership.
- Workspace roles: Settings → Workspace → Members, by a workspace admin, or in the invitation that brings someone in.
- The shared demo account reads everything and changes nothing, whatever its roles say.
A changed role applies on the person's next request, and someone who is removed loses access straight away.
Related
Still stuck?
Email us with what you tried and any request id. A person replies.