Users and roles

Open Manage → Users & roles. Each member has one role owned by the organization. A role is a named set of permissions, and its name does not confer access. You can rename the seeded roles or define your own.

Invite and assign members

Choose a role that covers the person’s work, then use the invitation controls. User management requires users:manage; creating and changing roles requires roles:manage. You can assign or edit only roles whose permissions you already hold, and cannot grant a permission you lack. Separate permissions govern deleting users and resetting another user’s MFA.

Members cannot change their own assignment or account status through user management. At least one active member must retain both users:manage and roles:manage so the organization keeps an access administrator.

Starting roles are editable

• Viewer starts with operational read access and usage visibility.
• Member adds management of tests, dashboards, alerts, incidents, infrastructure, saved queries and baselines, plus approved AI changes.
• Admin adds organization, user and role management. It does not initially include billing changes, SSO/MFA policy changes, account deletion or another member’s MFA reset.
• Owner starts with the full permission set. It has no hidden bypass or wildcard that automatically grants every future permission.

The role editor’s current permission list is authoritative. Existing roles can have different permissions after edits or migrations.

Edit permissions deliberately

Most resources have read and manage; management includes reading. Billing uses billing:view and billing:manage. AI writes require ai:execute alongside the affected resource permission. Provider configuration, skill edits and MCP token creation require ai:manage.

Secrets have separate secrets:read, secrets:manage and secrets:grant permissions. Neither test management nor security settings implicitly grants credential access. Empty roles are valid; personal sign-in settings remain available even without business-resource access.

Save a role after reviewing its complete permission set. If another administrator changed it first, reload and review rather than overwriting stale data. Server permission checks apply on subsequent requests, including AI/MCP tool calls; navigation refresh may follow later.

Remove an unused role

Reassign members, cancel pending invitations and change any SSO default using the role before deleting it. A role still referenced by those records cannot be deleted. See Security for the SSO default role.