Roles and permissions

Permissions on a board

Everything a person may do to a board comes down to seven permissions.

Permission	Allows
`view`	Open it, read its comments and history
`comment`	Comment, reply, resolve
`edit`	Change it, name and restore versions, move it, send it to the trash
`export`	Export or duplicate it
`share`	Share it with a person, or make a link — never above one’s own level
`operate`	Start and stop the sweeps of the agent attributed to it
`manage`	Restrict it, delete it forever, share it with a team or everyone, change anyone’s grant

manage is never granted: it comes from owning a personal board or administering the organization.

Role	On the organization’s boards	On the organization
Owner	Everything, everywhere, restricted or not	Everything an admin does, plus: grant the owner role, delete or export the organization, decide who creates API keys
Admin	Everything, everywhere, restricted or not	Members, teams, API keys, agents, security policy, domains, SSO, SCIM, audit trail, fields
Member	`edit` (and `share`, if member sharing is on) where nothing is restricted	Create boards and folders at the root; read the agents and their activity
Viewer	`view` and `export` where nothing is restricted	Read only. Creates, changes and shares nothing — but may duplicate a board into their own space

An organization always has at least one owner: the last one cannot leave, be demoted, be removed or delete their account.

Role	Manages the team
Owner, Admin	Add and remove its members (from the organization), change their roles, never above their own. Only a team owner or an organization admin makes a team owner
Member	—
Viewer	— and caps the team’s grants at `view` for this person

A grant on a board or folder carries a role and two switches:

How these combine is in how access works.