Roles & Permissions

Permissions are granted at three levels — the organization, the workspace, and the individual resource.

Organization roles

• Organization Member — uses the organization rather than building it: chats in the workspaces they belong to, reads whatever is shared with them, and creates and runs their own workflows there. Cannot create workspaces, connectors, document sources or skills.
• Organization Contributor — everything a member can do, plus creating workspaces and resources of their own.
• Organization Admin — everything a contributor can do, plus managing members and admins, sharing resources organization-wide, and viewing the admin dashboard and usage.
• Organization Owner — full control of the organization: all admin abilities plus provider keys, API tokens, and the audit trail. Acts as the owner of every workspace, connector, document source, and skill — but not workflows or chats, which stay private to the user who created them and are not visible to any other role.

Workspace roles

• Workspace Owner — manages a workspace: its settings, members, and which resources are attached to it.
• Workspace Member — can use a workspace they belong to.

Resource roles

• Connector Owner — the user who owns the connector; can update and delete it.
• Document Source Owner — the user who owns the document source; can update and delete it, and delete the documents inside it.
• Skill Owner — the user who owns the skill; can update and delete it.
• Workflow Owner — the user who owns the workflow; the only person who can see, run, update, or delete it. A workflow can only be created in a workspace its owner already belongs to, and it runs with that workspace's connectors, skills and document sources.
• Chat Owner — the user who owns the chat; can share, update, and archive it.

Connectors, document sources, and skills can each be shared in one of two ways:

• Organization-wide (Organization shared) — anyone in the organization can add the resource to their own workspaces.
• Workspace-limited (Workspace only) — the resource is available only in the workspaces it has been explicitly added to.

Organization level permissionsCopy Anchor Link

Permission	Organization Member	Organization Contributor	Organization Admin	Organization Owner
Add/remove organization admin	✗	✗	✓	✓
Add/remove organization member	✗	✗	✓	✓
Add/remove organization owner	✗	✗	✗	✓
Add/remove workspace member	✗	✗	✗	✓
Add/remove workspace owner	✗	✗	✗	✓
Configure organization provider keys and models	✗	✗	✗	✓
Create connector (org-wide)	✗	✗	✓	✓
Create connector (workspace-limited)	✗	✓	✓	✓
Create document (org-wide)	✗	✗	✓	✓
Create document (workspace-limited)	✗	✓	✓	✓
Create document source (org-wide)	✗	✗	✓	✓
Create document source (workspace-limited)	✗	✓	✓	✓
Create skill (org-wide)	✗	✗	✓	✓
Create skill (workspace-limited)	✗	✓	✓	✓
Create spend alert	✗	✗	✓	✓
Create suggestion	✗	✓	✓	✓
Create workflow	✗	✗	✗	✓
Create workspace	✗	✓	✓	✓
Manage API tokens	✗	✗	✗	✓
Run workflow	✗	✗	✗	✗
See admin dashboard	✗	✗	✓	✓
See audit trail	✗	✗	✗	✓
See chat	✗	✗	✗	✗
See connector (org-wide)	✓	✓	✓	✓
See connector (workspace-limited)	✗	✗	✗	✓
See document (org-wide)	✓	✓	✓	✓
See document (workspace-limited)	✗	✗	✗	✓
See document source (org-wide)	✓	✓	✓	✓
See document source (workspace-limited)	✗	✗	✗	✓
See skill (org-wide)	✓	✓	✓	✓
See skill (workspace-limited)	✗	✗	✗	✓
See spend alerts	✗	✗	✓	✓
See suggestions	✓	✓	✓	✓
See token usage	✗	✗	✓	✓
See workflow	✗	✗	✗	✗
See workflow chat	✗	✗	✗	✗
See workflow run	✗	✗	✗	✗
See workspace	✗	✗	✗	✓
Update connector	✗	✗	✗	✓
Update document source	✗	✗	✗	✓
Update organization settings	✗	✗	✓	✓
Update private chat	✗	✗	✗	✗
Update skill	✗	✗	✗	✓
Update workflow	✗	✗	✗	✗
Update workspace	✗	✗	✗	✓

Workspace level permissionsCopy Anchor Link

Permission	Workspace Member	Workspace Owner
Add/remove connector to workspace	✗	✓
Add/remove document source to workspace	✗	✓
Add/remove skill to workspace	✗	✓
Add/remove workspace member	✗	✓
Add/remove workspace owner	✗	✓
Configure auto approvals for their own user	✓	✓
Create connector (org-wide)	✗	✗
Create connector (workspace-limited)	✗	✓
Create document (org-wide)	✗	✗
Create document (workspace-limited)	✗	✓
Create document source (org-wide)	✗	✗
Create document source (workspace-limited)	✗	✓
Create skill (org-wide)	✗	✗
Create skill (workspace-limited)	✗	✓
Create spend alert	✗	✓
Create suggestion	✗	✓
Create workflow	✓	✓
Delete workspace	✗	✓
Manage suggestions	✗	✓
See suggestions	✓	✓
See workspace	✓	✓
Update workspace	✗	✓
Update workspace provider keys	✗	✓

Resource level permissionsCopy Anchor Link

These tables use two workspace-relative roles:

• Assigned Workspace Member — a member of a workspace the resource has been shared with.
• Other Workspace Member — a member of the organization who has not been given access to the resource.

Connector permissionsCopy Anchor Link

Permission	Other Workspace Member	Assigned Workspace Member	Connector Owner
Add/remove connector to workspace	✗	✗	✓
Configure connector tool	✗	✗	✓
Delete connector	✗	✗	✓
See connector (org-wide)	✓	✓	✓
See connector (workspace-limited)	✗	✓	✓
Update connector (also members)	✗	✗	✓

Document permissionsCopy Anchor Link

Permission	Other Workspace Member	Assigned Workspace Member	Document Source Owner
Delete document	✗	✗	✓
Move document	✗	✗	✓
See document (org-wide)	✓	✓	✓
See document (workspace-limited)	✗	✓	✓

Document Source permissionsCopy Anchor Link

Permission	Other Workspace Member	Assigned Workspace Member	Document Source Owner
Add/remove document source to workspace	✗	✗	✓
Create spend alert	—	—	✓
Delete document source	✗	✗	✓
Process document source	—	—	✓
See document source (org-wide)	✓	✓	✓
See document source (workspace-limited)	✗	✓	✓
Update document source	✗	✗	✓
Upload files to a document source	✗	—	✓

Skill permissionsCopy Anchor Link

Organization-wide skills are visible to everyone; workspace-limited skills are only visible through an assigned workspace.

Permission	Other Workspace Member	Assigned Workspace Member	Skill Owner
Add/remove skill to workspace	✗	✗	✓
Delete skill	✗	✗	✓
See skill (org-wide)	✓	✓	✓
See skill (workspace-limited)	✗	✓	✓
Update skill	✗	✗	✓

Workflow permissionsCopy Anchor Link

Permission	Organization Admin	Workflow Owner
Create spend alert	✓	✓
Delete workflow	—	✓
Run workflow	—	✓
See workflow	—	✓
See workflow run	—	✓
Update workflow	—	✓

Chat permissionsCopy Anchor Link

Permission	Chat Owner
Archive chat	✓
See chat	✓
See workflow chat	✓
Share chat	✓
Unarchive chat	✓
Update chat	✓