Roles

Every member of a workspace has one role. This table is the one the workspace checks before every action.

Permission	What it allows	Owner	Admin	Editor	Viewer
`workspace.read`	See the workspace, its projects and their versions, and read shared collections.	Yes	Yes	Yes	Yes
`project.write`	Create projects, push versions and edit shared collections.	Yes	Yes	Yes	No
`project.publish`	Publish the hosted reference and docs, set up Try it and its proxy, and publish collections to readers.	Yes	Yes	No	No
`project.delete`	Delete a project.	Yes	Yes	No	No
`keys.manage`	Create and revoke CI keys, and run the project’s hosted MCP server: its host, credential, keys, tools and sign-in.	Yes	Yes	No	No
`members.manage`	Invite and remove members, and change their roles.	Yes	Yes	No	No
`audit.read`	Read and export the audit log.	Yes	Yes	No	No
`sso.manage`	Set up SSO, its email domains, and whether it’s required.	Yes	No	No	No
`sso.break_glass`	Open a workspace that requires SSO without signing in through it. Each day it’s used is logged.	Yes	No	No	No
`billing.manage`	Start, change and cancel the subscription.	Yes	No	No	No
`workspace.rename`	Rename the workspace.	Yes	No	No	No
`workspace.delete`	Delete the workspace.	Yes	No	No	No

Admin and viewer come with SSO: see Plans and limits. On a plan without SSO, an admin acts as an editor, so a downgrade never gives anyone more.

When a role may not

A refused action answers with one of these: