Roles and permissions
Roles are held at two levels, the organization and the project. On a project where someone holds a project role, that role replaces their organization role.
The organization role says what someone may do with the organization itself, such as inviting people, connecting a model provider or reading the audit log. It also applies on every project of the organization, except where the person holds a project role: there, the project role replaces it, whether it is higher or lower. An organization Admin who is Viewer on a sensitive project is only a Viewer there. Someone whose organization role is Project only sees nothing in the organization except the projects that give them a role.
Organization roles
| Role | Can do |
|---|---|
Owner (owner) | Everything an Admin can do, plus managing the other owners, transferring the organization, activating the Enterprise license and deleting the organization |
Admin (admin) | Members and invitations, model providers, secrets, security settings (mandatory two-factor authentication, SSO in the Enterprise edition) and organization settings such as alerts; creating and deleting projects; Admin rights on every project |
Member (member) | Member rights on every project: build agents, save and publish versions, use the Playground |
Viewer (viewer) | Read the organization and its projects, runs, metrics and audit log; change nothing |
Project only (none) | Nothing at organization level: access comes only from project roles |
Project roles
| Role | Can do |
|---|---|
Owner (owner) | Everything an Admin can do on the project, plus handing the project over to another member |
Admin (admin) | Project settings, variables and members; API keys; collections and sources, MCP servers, skills and the Slack connection; deleting agents and the project |
Member (member) | Create and edit agents, save and publish versions, use the Playground, manage schedules; approve runs waiting for a human decision (Enterprise) |
Viewer (viewer) | Read the project's agents, versions, runs and metrics; change nothing |
Nobody grants a role above their own, and ownership of a project is never granted by invitation: an owner names another owner, or hands the project over.
A project keeps at least one owner: the last one cannot leave, be removed or be demoted. To step down, hand the project over: the recipient becomes owner and you become Admin. Leaving is also refused when it would give you back a higher organization role, unless nobody else in the organization could remove you. The refusal then says which role can.
Invitations
An Admin or an Owner invites someone by email, to the organization or to one project, with a role. No invitation can grant Owner. Someone who already has an account joins directly; someone who does not creates one from the invitation, and a session opens as soon as it is accepted. Copy link on the Organization screen produces the acceptance link for you to send yourself, for instance when no mail server is configured. It replaces the previous link.
Sessions
Studio sessions are opaque: a random identifier, stored only as a hash, carried in an HTTP-only cookie (with the __Host- prefix when the Studio is served over HTTPS). There is no token in browser storage and no JWT for a human. A session expires after 8 hours of inactivity or 30 days at most, whichever comes first. A new session replaces the current one at login and when two-factor authentication is turned on or off, and all of someone's sessions are revoked when their role changes or they are removed. Revocation takes effect immediately.