Roles & permissions
What each role can see and do, from Owner to Viewer, and how server grants narrow it further.
Each person has one role in an organization. Pick the one that matches the job:
| Role | For |
|---|---|
| Owner | Everything, including managing other Owners. |
| Admin | Manages people, MCP servers, tools and every setting. |
| SRE / DevOps | Runs the platform: onboards MCP servers, approves tools, investigates, schedules reports. |
| Engineering manager | Oversight: every run, report and the audit log. Invites developers, QA and viewers. |
| Developer / service owner | Investigates with the servers granted to developers, runs reports. |
| QA | Investigates with the servers granted to QA (for example staging), runs reports. |
| Viewer | Reads reports and the runs they're allowed to see. |
What each role can do
| Owner | Admin | SRE | Manager | Developer | QA | Viewer | |
|---|---|---|---|---|---|---|---|
| Overview, members list | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| See MCP servers | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Onboard and manage servers | ✓ | ✓ | ✓ | ||||
| Approve tools | ✓ | ✓ | ✓ | ||||
| Use every server, no grant needed | ✓ | ✓ | ✓ | ||||
| Investigate (chat with the agent) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Read reports | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Run a report now | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Create, pause and delete schedules | ✓ | ✓ | ✓ | ✓ | |||
| See everyone's runs | ✓ | ✓ | ✓ | ✓ | |||
| Audit log | ✓ | ✓ | ✓ | ✓ | |||
| Invite and manage members | everyone | all but Owners | Developers, QA, Viewers |
Server grants narrow it further
Managers, Developers, QA and Viewers use a server only if their role is granted it. A Developer can investigate, but only with the servers granted to Developers. See Role access.
- Runs: without See everyone's runs, you see your own chats, plus report runs built only from servers your role may use.
- Reports run with their creator's current role.
When access is refused
- A page your role can't open says which roles can, for example Developers can't approve tools. Owners, Admins and SREs can.
- An organization you don't belong to looks like it doesn't exist.