Roles and permissions

The roles

• Viewer: sees the organisation's projects and artifacts and installs them.
• Editor: everything a viewer can do, plus creating artifacts and publishing versions.
• Admin: everything an editor can do, plus Review decisions, inviting and removing people, teams, creating and archiving projects, and changing visibility.
• Owner: everything an admin can do, plus renaming the organisation.
• Guest: someone invited to one project. They can do only what their project role allows, in their own projects.

Project roles and project leads

On a project, someone can hold a higher role than their organisation role. It applies to that project only. An admin or the current lead can name someone Project lead with Make lead. A lead of editor rank or above can change that project's settings and make Review decisions there.

Roles only add up. Your role in a project is the highest of your organisation role, your team roles and your project role.

Someone who should see one project only

For an intern or contractor, invite them with the invitation's scope set to that project. They join the organisation as a Guest and become a member of that project with the role you picked.

A guest sees only their own projects and what is scoped to them. Other projects, organisation-wide artifacts, the organisation's knowledge and the member list stay hidden. Team roles do not apply to a guest. A guest can publish private artifacts, or artifacts scoped to their own projects, if their project role allows it.

To give a guest the whole organisation, an admin changes their role on the Members page.

Someone who joined through a project invitation before guests existed keeps their organisation role until an admin changes it.

The Members page

Open your organisations, pick one, then Members. Admins can change a member's role or select Remove. You can only manage people below your own role, and only grant up to your own. Owners can manage anyone.

An organisation must always keep at least one owner. Make someone else an owner before the last owner steps down or leaves.

"Insufficient permissions"

Code: forbidden

You are a member, but your role does not allow this, or you tried to grant or remove a role above your own. A few actions also refuse requests that do not come from the site itself, such as a script calling the help assistant's question log, or another website embedding a search, a download or your data export. Ask an admin or owner. If the message says your token lacks a scope, create one with that scope in Settings > API tokens.