Role permissions

Access is assigned separately for each project. Roles are ordered as viewer < member < admin < owner.

Action	Viewer	Member	Admin	Owner
Read the project, knowledge, runs, cost, and audit	✓	✓	✓	✓
Create and edit knowledge		✓	✓	✓
Request approvals, syncs, and AI actions		✓	✓	✓
View the API key list		✓	✓	✓
Create and revoke API keys			✓	✓
Approve, edit, and reject proposals			✓	✓
Connect sources and change settings			✓	✓
Invite and remove project members			✓	✓
Change a member's role				✓
Rename and delete a project				✓

Organization permissions

Organization role is first-class org_membership (ADR-0006), independent of project roles. Organization administrators and owners can create projects, manage organization invitations, and upgrade the plan and manage its billing (ADR-0053); only owners can rename or delete the organization. Project data access still requires a separate project membership row.

The last project owner cannot be removed or demoted from that project. The last organization owner cannot leave the org or be removed from org_membership. Assign another owner first.

API keys and MCP

An API key is scoped to one project. Treat creating one as granting access to that project's data. An MCP OAuth token is also scoped to one selected project. The user's role limits write and action tools, while read tools are available to all project members.