Roles and permissions
The six built-in organization roles, their current access, and how API keys and connected apps are authorized.
Access is granted per organization. A member's role controls both dashboard actions and authenticated API requests made as that member.
Built-in roles
| Role | Current access |
|---|---|
| Owner | Full access to everything, including billing and organization management. |
| Admin | Full access to product services, API keys, media, telemetry, NovaPilot, NovaSynth, analytics, and guardrails. Can update the organization, invite members, and manage roles. Billing is read-only, and the organization cannot be deleted. |
| AI Engineer | Can ingest traces and create or edit projects, but cannot delete either. Has full access to datasets, ETL, evals, scorers, providers, API keys, media, NovaPilot, NovaSynth, and guardrails. Organization details, billing, telemetry plugins, and analytics are read-only. |
| Developer | Can ingest traces; create or edit projects and telemetry plugins; manage API keys and media; create, edit, and run NovaSynth tests; and create, edit, or report guardrail usage. The evaluation stack, organization details, billing, NovaPilot, and analytics are read-only. Cannot delete traces, projects, telemetry plugins, NovaSynth resources, or guardrails. |
| Product Manager | Can read every product surface and create, edit, and publish datasets. Cannot delete datasets or run ETL, evaluation, NovaPilot, or NovaSynth jobs. Has no API-key or telemetry-plugin access. |
| Viewer | Read-only access to every product surface, organization details, billing, and media. Has no API-key or telemetry-plugin access. |
AI Engineers and Developers can both ingest traces, create or edit projects, and manage API keys. Developers can configure telemetry plugins. AI Engineers can change and run evaluation data, jobs, scorers, providers, and NovaPilot analyses. Neither role can delete traces or projects.
Exact permission grants
These are direct grants. A service wildcard grants every action currently defined for that service.
- Owner (
owner):*:* - Admin (
admin):traces:*,datasets:*,etl:*,evals:*,scorers:*,providers:*,projects:*,org:read,org:write,org:invite,org:manage_roles,api_keys:*,billing:read,media:*,telemetry_plugins:*,novapilot:*,analytics:*,synthetic:*,guardrails:* - AI Engineer (
ai-engineer):traces:read,traces:write,datasets:*,etl:*,evals:*,scorers:*,providers:*,projects:read,projects:write,org:read,api_keys:*,billing:read,media:*,telemetry_plugins:read,novapilot:*,analytics:read,synthetic:*,guardrails:* - Developer (
developer):traces:read,traces:write,projects:read,projects:write,api_keys:*,datasets:read,etl:read,evals:read,scorers:read,providers:read,org:read,billing:read,media:*,telemetry_plugins:read,telemetry_plugins:write,novapilot:read,analytics:read,synthetic:read,synthetic:write,synthetic:execute,guardrails:read,guardrails:write,guardrails:ingest - Product Manager (
product-manager):traces:read,datasets:read,datasets:write,datasets:publish,etl:read,evals:read,scorers:read,providers:read,projects:read,org:read,billing:read,media:read,novapilot:read,analytics:read,synthetic:read,guardrails:read - Viewer (
viewer):traces:read,datasets:read,etl:read,evals:read,scorers:read,providers:read,projects:read,org:read,billing:read,media:read,novapilot:read,analytics:read,synthetic:read,guardrails:read
Permission format
A permission is written as service:action. Current services are:
traces, datasets, etl, evals, scorers, providers, projects, org, api_keys, billing, media, telemetry_plugins, novapilot, analytics, synthetic, and guardrails.
Actions are read, write, delete, execute, publish, invite, manage_roles, manage_billing, and ingest. A service wildcard such as traces:* grants every action for that service; *:* grants everything.
Open Organization Settings → Members → View role permissions before changing a member's role. The dialog summarizes nine core capabilities; the role table above also includes services such as providers, media, telemetry, NovaPilot, analytics, NovaSynth, and guardrails that are not columns in that summary dialog.
Inviting members and changing roles
Use Organization Settings → Members to invite a member and select a role. A later role change requires org:manage_roles. Only an Owner can assign the Owner role, and the organization must retain at least one Owner.
Denied actions and the audit log
A denied protected action returns HTTP 403 with the FORBIDDEN code and an insufficient-permissions message.
Authorization decisions are written to the authorization audit log. There is currently no audit-log page in the dashboard. Members with org:manage_roles can query the organization-scoped API endpoint GET /api/v1/rbac/audit-log, including filters for result, action, subject, and time range.
API keys
API keys authenticate machines and are scoped to the organization that created them. In the current dashboard you choose a title and optional expiry; there is no role selector. A role-less key acts with the current organization permissions of its creator, so changing that member's role changes what the key can do.
The full value is returned only when the key is created. Afterwards the dashboard shows only its final four characters. Rotate a key by creating a replacement, updating the client, and deleting the old key.
API-key-authenticated requests cannot use the session-only API-key management route to create another key. They also remain restricted to their own organization and to the permissions resolved for their creator or assigned API-key role.
Connected apps
OAuth grants appear under Account Settings → Connected apps and can be revoked independently. The effective access of a connected app is the intersection of its approved OAuth scopes and the member's organization permissions.
This is the authentication path used by MCP clients that sign in interactively. Headless clients can use a Bearer API key instead.