Team roles and permissions

This guide describes the roles and permissions of team admins and team members. A user can have admin and member permissions at the same time.

User management

Action	Team admin	Team member
Add/remove users from a team	✅	—
Promote team members to admins	✅	—

Spaces

Action	Team admin	Team member
Browse a space's content	✅	✅
Create a space	✅	✅
Edit a space	✅	✅¹
Delete a space	✅	✅¹
Change visibility of a space	✅	—
Manage user access to a space	✅	—
Publish a space to gallery	✅	—

¹ Only for spaces where the member has Edit access. Members with View access can browse and run workflows in the space, but cannot edit or delete items. See Create and manage spaces for how space-level access is granted.

Versioning

Action	Team admin	Team member
View older versions	✅	✅
Create a version	✅	✅¹
Restore a version	✅	✅¹
Delete a version	✅	—

¹ Requires Edit access to the space the item lives in.

Workflows

Action	Team admin	Team member
Create, edit, or delete a workflow	✅	✅¹
Run a workflow manually	✅	✅
Create a deployment	✅	✅

¹ Requires Can Edit access to that space.

Deployments

Access to a deployment depends on the access level granted, not only on team membership.

Access level	Can do
Run	Run the deployment
Run & Inspect	Run the deployment and inspect its runs
Manage	Run, inspect, edit, delete, and manage access to the deployment

Within the team that owns a deployment, admins always have Manage access, and members get Manage access by default. A deployment can also be shared with members of other teams, though they can only be granted Run access.

Secrets

Secret scope determines who can create and use secrets:

Scope	Who can create	Who can use
Personal	Any user	The owner only — cannot be shared
Team	Team admins only	Team members with Use or Edit access, plus any other user or team with explicit access
Global	Global admins only	Users and teams with explicit access

GenAI Gateway

GenAI model scope determines who can create and use models:

Scope	Who can create	Who can use
Team	Team admins only	Members of the owning team, or of any other team the model is shared with, with Use or Edit access
Global	Global admins only	Members of any team the model is shared with