Roles Reference
What each role can do in a project. The item names follow what the screen shows. How the roles work is covered in Who decides what.
- Owner and member — the roles of a project's participants. They are set under the Settings tab ＞ “Members”, or by an organization admin under “Organization projects” in the admin console. Whoever creates a project becomes its owner
- Organization admin and system administrator — roles in the admin console. These roles alone do not open a project's screens (except viewing and copying projects under “Public Projects”). The tables list only what can be done to a project from the admin console
Roles can be combined. Each column shows what that role alone allows. Someone with several roles should read the matching columns together.
Some rules sit apart from the roles. A review request can be decided only by someone named as its reviewer. An agent can be changed only by its owner.
Seeing
| What you can do | Owner | Member | Organization admin | System administrator |
|---|---|---|---|---|
| See Overview, KPI, Execution history, Workflow history and Records (audit trail) | ○ | ○ | — | — |
| The KPI “CSV”, and “Export CSV” on Records (audit trail) | ○ | ○ | — | — |
| See the Settings tab (Basic information, Triggers and notifications 〔“Triggers” for a cycle〕, Connectors, Members, Execution rules) | ○ | ○ | — | — |
| See run records | ○ | ○ | Under “Execution history” in the admin console, only runs whose “User” belongs to an organization they are responsible for | Under “Execution history” in the admin console, all runs |
| Open the body of a record (a reason is required) | ○ | ○ | Under “Execution history” in the admin console, only runs whose “User” belongs to an organization they are responsible for | — |
| Preview and download the “Input files set on the Agent”, “Files received from the previous step” and “Artifacts” listed in a run record | ○ | ○ | — | — |
| Export a run record (a reason is required) | ○ | ○ | Under “Execution history” in the admin console, only runs whose “User” belongs to an organization they are responsible for | Under “Execution history” in the admin console, all runs |
| See review requests | ○ (even when not a reviewer) | Only those they are named as a reviewer on | Under “Review requests” in the admin console, only those not yet decided that have a reviewer from an organization they are responsible for (viewing only) | — |
| See the projects tied to an organization they are responsible for, and their participants | — | — | “Organization projects” in the admin console | — |
| See the project's execution rules | ○ | ○ | — | — |
| See “Who viewed this record” on a run record | ○ | ○ | — | — |
| See the current settings of the agent in charge with “View current settings” on a run record (unless it has been removed with “Remove from project”) | ○ | ○ | — | — |
Changing
| What you can do | Owner | Member | Organization admin | System administrator |
|---|---|---|---|---|
| Edit steps and agent placements and apply them (“Edit”) | ○ | — | — | — |
| Name the reviewers and the escalation contact when overdue | ○ | — | — | — |
| Change the basic information | ○ | — | — | — |
| Set the organization after the project is created | Once, while it has “No organization”; only an organization they currently belong to | — | — | — |
| Add members, change roles, remove members | ○ (a change that would leave no owner is not possible) | — | Under “Organization projects” in the admin console: add people from an organization they are responsible for, as members or owners, to a project tied to that organization, and make a member an owner (removing people and turning an owner into a member are not possible) | — |
| Add, connect, re-authenticate, disconnect, switch “Ledger” for, or remove a connector | ○ | — | — | — |
| Change the project's execution rules (basic rules, forbidden operations, review methods, retries, send-back limit) | ○ | — | — | — |
| Change triggers (time triggers, webhook triggers, “Start by email”) and notifications | ○ | — | — | — |
| Choose the company memory | ○ | — | — | — |
| Publish or unpublish the project | ○ | — | — | — |
| Duplicate the project | ○ | — | — | — |
| Delete the project | ○ | — | — | — |
Running and stopping
| What you can do | Owner | Member | Organization admin | System administrator |
|---|---|---|---|---|
| Run a workflow by hand (“Run now”) | ○ | — | — | — |
| Start from the external API with their own access token (starting a workflow run, calling a webhook trigger) | ○ | — | — | — |
| Start a run by email (where “Start by email” is in use) | ○ | ○ | — | — |
| Pause and resume | ○ | — | — | — |
| Cancel a run, stop a sweep | ○ | — | — | — |
| Decide a review request | When named as its reviewer. A review request raised from the result of a “Run by Agent” step has, as a rule, every owner at the time it was raised as a reviewer (likewise on a review step, if every named reviewer had been removed from the members when it was raised) | When named as its reviewer | — | — |
| Ask for improvement ideas | ○ | ○ | — | — |
| Apply an improvement idea | ○ | — | — | — |
Starting by email also works from an external address the owners have allowed, provided the email passes sender authentication. When an app calls the external API, what it can do is settled by the projects and operations allowed to that app, not by a user's role. Neither is a power given by a role.
Settled for the whole tenant
These are settled outside the project, by a system administrator in the admin console. The result takes effect in projects.
| What you can do | Owner | Member | Organization admin | System administrator |
|---|---|---|---|---|
| See and settle the tenant-wide execution rules (“Execution rules” in the admin console) | — | — | See only | ○ |
| Prepare the connector candidates (external services, agent-to-agent integrations) in the admin console | — | — | — | ○ |
| Grant and revoke the organization admin role (“Organization Roles” in the admin console; it can be granted only to someone who belongs to that organization) | — | — | — | ○ |
| Settle “Guardrails Settings” in the admin console (personal information masking and so on) | — | — | — | ○ |
What anyone can do, whatever the role
- Create a project (whoever creates it becomes its owner; when creating it, they can set an organization they currently belong to)
- See and copy a published project from the “Public Projects” list (whoever copies it becomes the owner of the copy)
- Change the agents, skills and playbooks they own
What to read next
- Who decides what — the layers of roles, and the power to decide a review
- Review Guide — how to name reviewers
- Settings Reference — the fixed values