Skip to main content

Roles

The Roles page controls what each admin user can see and do through fine-grained permission scopes. Open it by selecting Manage Roles on the Admin Users page.

Roles fall into two kinds: predefined roles that every organization ships with, and custom roles you build for your own needs.

Roles page listing the predefined owner, security, it, and readonly roles with their descriptions and permission scope counts, plus a New Role button and search box

Built-in role templates​

The following predefined roles are available in every organization. They are marked Predefined and cannot be modified.

RoleDescription
ownerFull access to all features and settings.
securitySecurity-focused role: publish artifacts; manage guards, monitoring, and audit. Cannot create or edit artifacts.
itIT-focused role: manage integrations, toolkits, skills, and users. No billing or role management.
readonlyRead-only access to all resources.

Permission scopes​

When creating a custom role, you select permissions from the following categories. Each category exposes its own set of actions.

CategoryAvailable actions
Integrations (MCPs)View, Create, Edit, Delete, Publish
ToolkitsView, Create, Edit, Delete, Publish
SkillsView, Create, Edit, Delete, Publish
CommandsView, Create, Edit, Delete
RulesView, Create, Edit, Delete
HooksView, Create, Edit, Delete
PluginsView, Create, Edit, Delete
GuardsView, Create, Edit, Delete
End UsersView, Invite, Edit, Delete
Admin UsersView, Invite, Edit, Delete, Manage Roles
OrganizationView Settings, Edit Settings, Billing
GroupsView, Create, Edit, Delete
Monitoring & Shadow AIView, Manage
AuditView Logs
Manage Roles permission

The Manage Roles permission (under Admin Users) is required to create, edit, or delete custom roles and to change another admin's role assignment.

Create a custom role​

  1. Select New Role.
  2. Enter a name (for example, Developer or Viewer) and an optional description.
  3. Select the permission scopes this role should have.
  4. Select Create.
Create Custom Role modal with Name and Description fields and permission groups such as Integrations, Toolkits, Skills, Commands, and Guards, each with View, Create, Edit, Delete, and Publish checkboxes

New custom roles appear in the role selector when inviting or editing an admin user.

Edit or delete a role​

Select a custom role in the list to edit its name, description, or scopes. Deleting a role does not remove admin users who hold it; they fall back to no custom role assignment.

What to do next​

On this page