Roles reference

Roles are granted at two independent scopes. Tenant roles control organization-wide administration. Work area roles control what a person can do inside one work area. Access is derived from both when a request is made, rather than stored as a fixed grant.

• Deployment: SaaS, On-premises

A user can hold a role directly, or inherit one from a group. Where both apply, the stronger role wins.

Tenant roles

Tenant roles apply across the whole organization. The wire value is the exact string the platform stores and reports for the role. The following table lists them, strongest first:

Role	Wire value	Summary
Owner	Owner	Full control, including billing and tenant deletion
Admin	Admin	All administration except billing and Owner changes
Global viewer	GlobalViewer	Read-only access to every work area
Member	Member	Access to their own activity only

Precedence is Owner then Admin then GlobalViewer then Member. When several grants confer different roles, for example a direct grant and a group, the strongest applies.

What each tenant role can do

Owner exceeds Admin in exactly three capabilities: billing, Owner management, and tenant deletion. The following table lists every tenant capability and the roles that satisfy it:

Capability	Owner	Admin	Global viewer	Member
Manage billing	Yes	No	No	No
Promote or demote Owners	Yes	No	No	No
Purge the tenant	Yes	No	No	No
Manage tenant settings, such as transactional email	Yes	Yes	No	No
Create, edit, and delete work areas	Yes	Yes	No	No
Manage users, groups, and role grants	Yes	Yes	No	No
Configure source and provider integrations	Yes	Yes	No	No
Issue install tokens for workstation setup	Yes	Yes	No	No
Force-verify a committer email	Yes	Yes	No	No
Link and unlink developer identities	Yes	Yes	No	No
Open developer activity trace surfaces	Yes	Yes	No	No
Force a report to regenerate	Yes	Yes	No	No
Rebuild all analytics models for the tenant	Yes	Yes	No	No
Reprocess AI analysis payloads	Yes	Yes	No	No
Collect and download support bundle logs	Yes	Yes	No	No
View every work area in the tenant, read-only	Yes	Yes	Yes	No
Sign in and view their own activity	Yes	Yes	Yes	Yes

Grant Owner sparingly. The platform blocks removal of the last remaining Owner grant, so an organization always retains one.

Work area roles

Work area roles apply to a single work area. Admin, Viewer, and Self-only are granted to a user or to a group; Owner is granted only to a user, and only by reassigning ownership. Owner, Admin, and Viewer rank strongest to weakest; Self-only sits outside that ranking — see Understand how grants combine for how it interacts with a stronger grant. The following table lists them:

Role	Wire value	Summary
Owner	Owner	Full control of the work area, including reassigning ownership
Admin	Admin	Edit the work area and its grants
Viewer	Viewer	Read the aggregate dashboards
Self-only	SelfOnly	See only their own activity within the work area

Self-only is a narrowing rather than a rank, and it does not override a stronger grant from another source. A self-only member with no other grant on the work area sees only their own activity inside its filter. If the same person also holds Viewer or Admin on that work area, directly or through a group, the most-permissive-wins rule in Manage access with groups applies, and the stronger grant wins.

What each work area role can do

The following table lists every work area capability and the roles that satisfy it:

Capability	Owner	Admin	Viewer	Self-only
Reassign work area ownership	Yes	No	No	No
Edit the filter, grants, and display name	Yes	Yes	No	No
Force a report to regenerate	Yes	Yes	No	No
Read the aggregate dashboards	Yes	Yes	Yes	No
Open their own activity view in the work area	Yes	Yes	Yes	Yes

Tenant roles and work area roles are separate

Holding a tenant role does not by itself decide what a given work area shows, because a work area carries its own membership. The two interact in exactly two places:

• Global viewer and above read every work area without needing a grant on each one.
• Owner and Admin manage work areas, which includes granting roles on a work area they do not otherwise belong to.

Everything else is governed by the work area's own grants.

Roles in invites differ from roles in the members list

Invites use a shorter role vocabulary than the members list, and the two do not map one to one. The following table lists the mapping:

Invite role	Tenant role granted on acceptance
owner	Owner
admin	Admin
user	Member

There is no invite role that grants Global viewer. Invite the person as user, then change their role to Global viewer after they accept. Treat the members list as authoritative for anyone already in the organization: a Global viewer also reports back as user where invites report an existing member.

Related

• Invite users to your organization — choosing the role an invite carries.
• Work areas — what a work area role applies to.
• Members and developers — why access and activity attribution are separate.
• Create a work area — granting roles on a new work area.