Scopes and roles

Permissions in an organization are member scopes. A role gives a member a default set of scopes, and an owner or anyone with permissions:manage can adjust a member’s scopes individually under Settings, Members.

Roles

Role	Default permissions
Owner	Everything in the organization. Ownership is a separate fact that scopes cannot grant; transfer it explicitly.
Admin	All organization permissions, including managing other members’ scopes.
Member	Day-to-day work: sessions, the LLM API, engagements, dashboards, MCP servers, integrations (integrations:read, integrations:use and integrations:manage), reading their own usage, reading settings, listing keys, creating and editing playbooks and skills, and working with AI engineers.
Viewer	Read-only: every :read scope in the table below except mcp:read. Organization-wide usage and other members’ audit trail need usage:read:org and audit:read:org, which a viewer does not get.

Member scopes

The member scopes for the features these docs cover:

Area	Scopes
Organization	org:read, org:manage, org:invite, org:billing:read, org:billing:manage
Permissions	permissions:manage
API keys	keys:read, keys:create, keys:revoke, keys:rotate
LLM API	llm:access, llm:chat, llm:embeddings, llm:batch, llm:models:read
Usage	usage:read, usage:read:org
Settings and audit	settings:read, settings:write, audit:read, audit:export, audit:read:org, audit:export:org
Integrations	integrations:read, integrations:use, integrations:manage, integrations:notify, integrations:slack:manage, integrations:jira:manage
MCP servers	mcp:read, mcp:manage
Engagements and vault	engagement:read, engagement:write, vault:read, vault:write, vault:use, vault:delete
Dashboard	dashboard:read, dashboard:write
Library	skills:read, skills:create, skills:edit, skills:delete, playbooks:read, playbooks:create, playbooks:edit, playbooks:delete
AI engineers	staff:read, staff:chat, staff:operate, staff:manage, staff:create, staff:delete, staff:contacts:manage, staff:targets:manage, staff:autonomy:manage, staff:approvals:decide, staff:billing

Each scope is granted on its own. A wildcard such as integrations:* is not a member scope: granting it is refused as an unknown scope.

Member scopes and API keys

API keys carry their own scopes for the LLM API and key management. On the Platform API, a key acts with the member scopes of the person who owns it. See Authentication and API keys.

Note

A denied action is recorded in the audit log, so attempts to use permissions a member does not have are visible to admins.