> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and Permissions

> Look up what Owner, Admin, Developer, and Viewer can do in your organization and each workspace before you assign a role.

Every person in CloudThinker has one organization role, and that role decides which workspaces they can open and what they can do there. Use this page to give each person the smallest role that covers their job. Every row matches a permission check CloudThinker enforces.

## How organization and workspace roles combine

An **organization** is your company account: billing, members and identity settings. A **workspace** is a separate area inside it with its own connections, agents, findings and conversations. See [Concepts](https://docs.cloudthinker.io/guide/concepts.md) for the full model.

The organization **Owner** is the highest role and pays for the organization. Organization **Admins** can set up everything in the organization except the Owner-only rows in [Organization permissions](#organization-permissions) below.

| Organization role | Which workspaces | Role inside a workspace |
| - | - | - |
| **Owner** | Every workspace, automatically | Admin, fixed |
| **Admin** | Every workspace, automatically | Admin, fixed |
| **Developer** | Only workspaces they're added to | Developer, unless you set an override |
| **Viewer** | Only workspaces they're added to | Viewer, unless you set an override |

* **Override**: a different role for one person in one workspace. It can raise or lower their role, for example making a Developer the Admin of their team's workspace, or a Viewer in a workspace they should only read. Owners and Admins can't be overridden. Set it in [workspace members](https://docs.cloudthinker.io/guide/workspace-users.md).
* **Member** is a legacy organization role. It works exactly like Developer.
* **Workspace owner**: not a role. It's the single person recorded as owning one workspace. They can open that workspace in their own right, whatever their role, and they receive its notices — a connection that breaks, an alert with no other recipient. A workspace created by an organization rather than a person can have no owner at all. Where this guide says **Admin**, it means the role and its permissions; where it says **owner**, it means this one person.
* **Owner**: each organization has exactly one. You can't invite someone as Owner or pick the role for them. There's no transfer control in the app: the current Owner emails support to [transfer ownership](https://docs.cloudthinker.io/guide/organization.md#transfer-ownership), and the old Owner becomes an Admin.

## Organization permissions

Organization settings live in **Admin Settings**, which only Owners and Admins can open. A workspace Admin who isn't an organization Admin (for example, a Developer with an Admin override) doesn't see Admin Settings in their menu. They can open one page there from a direct link, **Guardrails**, and nothing else. They set their workspace's own LLM key in **More → Workspace settings → BYOK** instead.

| Action | Owner | Admin | Developer | Viewer |
| - | :-: | :-: | :-: | :-: |
| See the organization name and the workspaces they can open | Yes | Yes | Yes | Yes |
| See the full member list, in **Admin Settings → Organization** | Yes | Yes | No | No |
| Rename the organization | Yes | Yes | No | No |
| Invite members as Developer, Viewer or Admin | Yes | Yes | No | No |
| Remove members | Yes | Yes, except Admins and the Owner | No | No |
| Change a member's role to Developer or Viewer | Yes | Yes, except Admins and the Owner | No | No |
| Change an existing member's role to Admin | Yes | No | No | No |
| Choose which workspaces a Developer or Viewer can open | Yes | Yes | No | No |
| Create workspaces | Yes | Yes | No | No |
| Delete workspaces, in **Admin Settings → Workspaces** | Yes | Yes | No | No |
| View [usage](https://docs.cloudthinker.io/guide/billing/usage.md) | Yes | Yes | No | No |
| Set [workspace credit limits](https://docs.cloudthinker.io/guide/billing/credit-limits.md) | Yes | Yes | No | No |
| Manage organization [guardrails](https://docs.cloudthinker.io/guide/security/custom-guardrails.md) | Yes | Yes | No | No |
| View [audit logs](https://docs.cloudthinker.io/guide/security/audit-logs.md) | Yes | Yes | No | No |
| Manage the [subscription](https://docs.cloudthinker.io/guide/billing/subscription.md) and payment | Yes | No | No | No |
| Manage organization [BYOK](https://docs.cloudthinker.io/guide/byok.md) (your own LLM credentials), in **Admin Settings → BYOK** | Yes | No | No | No |
| Change anything in **Admin Settings → Identity and access**: [SSO](https://docs.cloudthinker.io/guide/security/sso.md), [SCIM](https://docs.cloudthinker.io/guide/security/scim.md), domain verification and auto-assigned workspaces | Yes | No | No | No |
| Restrict which email domains can be invited | Yes | No | No | No |
| Change [Capabilities](https://docs.cloudthinker.io/guide/capabilities.md) (who decides which capabilities run in your workspaces) | Yes | No | No | No |
| Request an ownership transfer (by email to support) | Yes | No | No | No |
| Delete the organization (only when the Owner is the last active member) | Yes | No | No | No |

Admins can invite someone as Admin but can't promote an existing member to Admin. Nobody can be invited as Owner.

## Workspace permissions

These apply inside one workspace. Organization Owners and Admins always get the Admin column. Deleting a workspace isn't a workspace permission: only organization Owners and Admins can do it, from **Admin Settings → Workspaces**. Viewers are read-only: they can't chat with CloudThinker, run commands, or start any agent work. The one exception is that any member, Viewers included, can install a [Skills Hub](https://docs.cloudthinker.io/guide/skills/overview.md) skill into the workspace.

| Area | Viewer | Developer | Admin |
| - | - | - | - |
| General workspace pages: findings, incidents, agents, connections, knowledge, memory | View | View | View |
| Chat with CloudThinker | No | Yes | Yes |
| Rename and star conversations | No | Yes | Yes |
| Run [commands](https://docs.cloudthinker.io/guide/commands.md) | No | Yes | Yes |
| Create, edit, import and delete commands (built-in commands are read-only) | No, view only | Yes | Yes |
| Delete conversations | No | No | Yes. An [Agent CLI](https://docs.cloudthinker.io/guide/cli/agent.md) session is the exception: only the person who started it can delete it |
| Dashboards | View | Create and edit | Create and edit |
| [Custom agents](https://docs.cloudthinker.io/guide/agents/customize.md) | View | Create and edit | Create and edit |
| [Automations](https://docs.cloudthinker.io/guide/automation/automations.md) | View | View | Create, edit, run, delete |
| [Optimize](https://docs.cloudthinker.io/guide/cost-optimization/overview.md) scans and [findings](https://docs.cloudthinker.io/guide/cost-optimization/recommendations.md) | View | Run scans, and move, edit, and assign findings | Same as Developer |
| Optimize finding marks: expected, snoozed, or disputed | No | No | Manage |
| [Review](https://docs.cloudthinker.io/guide/code-review/overview.md) reviews | View | Re-run, resolve findings, apply fixes, merge | Same, plus set up repositories and review mode, and delete |
| Review [Learnings](https://docs.cloudthinker.io/guide/code-review/convention-rules.md) | View | View | Edit |
| [Cyber](https://docs.cloudthinker.io/guide/security/cyber-overview.md) tests | View | Create, edit, run | Create, edit, run, delete |
| [Resolve](https://docs.cloudthinker.io/guide/incident/overview.md) incidents and alerts | View | View | Edit and delete |
| [Pulse](https://docs.cloudthinker.io/guide/pulse/overview.md) settings | View | View | Manage |
| [Connections](https://docs.cloudthinker.io/guide/connections/overview.md), including cloud accounts | View | View | Add, edit, remove |
| [Custom skills](https://docs.cloudthinker.io/guide/skills/custom-skills.md) | View | View | Create, edit, delete |
| [Credentials](https://docs.cloudthinker.io/guide/credentials.md) | No (the tab opens locked) | No (the tab opens locked) | View and manage |
| [Knowledge](https://docs.cloudthinker.io/guide/knowledge.md) bases | View | View | Manage |
| [Memory](https://docs.cloudthinker.io/guide/memory.md) | View | View | Manage |
| [Approval rules and mode](https://docs.cloudthinker.io/guide/approvals/overview.md) | View | View | Manage |
| [Notifications](https://docs.cloudthinker.io/guide/notifications.md) and [webhooks](https://docs.cloudthinker.io/guide/webhooks/overview.md) | View | View | Manage |
| Workspace [guardrails](https://docs.cloudthinker.io/guide/security/custom-guardrails.md) | No | No | Manage |
| Workspace [members](https://docs.cloudthinker.io/guide/workspace-users.md) and roles | View | View | Manage |
| [Branding](https://docs.cloudthinker.io/guide/workspace-branding.md) and general settings, including workspace [capabilities](https://docs.cloudthinker.io/guide/capabilities.md) | View | View | Manage |
| Workspace [BYOK](https://docs.cloudthinker.io/guide/byok.md), in **More → Workspace settings → BYOK** | No | No | Manage |
| Leave the workspace (organization Owners and Admins can't leave individual workspaces) | Yes | Yes | Yes |

> [!NOTE]
>
> Developers can apply fixes and merge pull requests from Review. If someone shouldn't merge, give them Viewer in that workspace.

Who can approve an agent's action is set separately from these roles. See [Approvers](https://docs.cloudthinker.io/guide/approvals/approvers.md).

## Choose a role

| Person | Organization role | Why |
| - | - | - |
| Platform lead who also owns billing and SSO | Owner | Needs the Owner-only settings: billing, BYOK and SSO |
| Engineering manager who adds people and workspaces | Admin | Manages members and workspaces without payment or SSO control |
| Engineer who chats with CloudThinker, runs Cyber tests and works Review findings | Developer | Day-to-day work without changing connections or settings |
| Engineer who owns one team's workspace | Developer, with an Admin override in that workspace | Admin power stays inside one workspace |
| Auditor, executive or stakeholder who only reads | Viewer | Sees results and can't chat, run commands, or start agent work |

Every role uses a seat on per-seat plans, Viewer included, and so does each pending invitation until it expires after 7 days. **Inactive** members (provisioned while no seat was free) don't use one until you activate them. See [Add or remove seats](https://docs.cloudthinker.io/guide/billing/subscription.md#add-or-remove-seats).

If you provision people with [SCIM](https://docs.cloudthinker.io/guide/security/scim.md), new members get the **Auto-assigned organization role** you set there, **Viewer** by default.

## What changes when a role changes

* The new role applies from the person's next request. They don't need to sign out.
* If someone loses access to a workspace (for example, an Admin demoted to Developer who was never added to it), the [automations](https://docs.cloudthinker.io/guide/automation/automations.md) they own there are turned off. A workspace Admin can [take ownership](https://docs.cloudthinker.io/guide/automation/autonomous-agents.md) and turn them back on.
* Removing someone from the organization removes them from every workspace. Members provisioned through SCIM are removed in your identity provider instead.
* Role changes, invites and removals are recorded in [audit logs](https://docs.cloudthinker.io/guide/security/audit-logs.md).

## Next steps

> **[Organization](https://docs.cloudthinker.io/guide/organization.md)**
>
> Invite members and change organization roles.

> **[Workspace members](https://docs.cloudthinker.io/guide/workspace-users.md)**
>
> Add people to workspaces and set role overrides.

> **[SCIM provisioning](https://docs.cloudthinker.io/guide/security/scim.md)**
>
> Assign roles automatically from your identity provider.

> **[Approvers](https://docs.cloudthinker.io/guide/approvals/approvers.md)**
>
> Control who can approve agent actions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.