Roles & Permissions

Future AGI provides a role-based access control (RBAC) system with two levels: organization roles and workspace roles. This guide explains what each role can do and how access works across your team.

---

Organization Roles

Every user in your organization has one of four roles. These control what the user can do across the entire organization.

Role	Description
Owner	Full control over the organization. Can manage billing, settings, members, and all workspaces. Every organization must have at least one owner.
Admin	Same access as Owner, except cannot manage Owners or other Admins. Automatically gets admin access to all workspaces.
Member	Can view resources across the organization. Cannot manage members or organization settings.
Viewer	Read-only access. Can view data but cannot create, edit, or delete anything.

---

Workspace Roles

Workspaces let you organize projects, datasets, traces, and queues into separate groups. Users who are not Org Admins or Owners need explicit workspace membership to access a workspace.

Role	Can View	Can Edit	Can Manage Members
Workspace Admin	Yes	Yes	Yes
Workspace Member	Yes	Yes	No
Workspace Viewer	Yes	No	No

You can view workspace members and their roles from the workspace settings page.

How workspace access is determined

A user’s effective workspace access is the higher of their organization role and their workspace role:

• An Org Admin always has Workspace Admin access everywhere, even without explicit workspace membership
• An Org Member with Workspace Admin on a specific workspace gets admin access only in that workspace
• An Org Member with no workspace membership has no access to that workspace

---

Inviting Users

Org Admins and Workspace Admins can invite new users to the organization. You can manage all members from the Organization > Members page.

Invitation rules

• You can only invite users at a role equal to or below your own role. An Admin cannot invite an Owner.
• Workspace Admins can invite users but only grant access to workspaces they manage.
• If an invite is not accepted within 7 days, it expires. You can resend it from the members list.

---

Managing Members

Changing a user’s role

Org Admins and Owners can change any member’s organization role or workspace role from the Users page.

• You cannot manage a user at or above your own role (escalation prevention). Only Owners can manage other Owners.
• If you promote a user to Admin or Owner, they automatically get Workspace Admin access to all workspaces
• If you demote an Admin to Member, their workspace access reverts to their explicit workspace memberships

Removing a user

• Removing a user from the organization also removes them from all workspaces
• Removing a user from a workspace only removes workspace access — they stay in the organization
• You cannot remove the last Owner of an organization
• You cannot remove yourself

Reactivating a user

Previously removed users can be reactivated from the members list. Their original role is preserved.

---

Permission Summary

Action	Owner	Admin	Member	Viewer
View traces, sessions, datasets	Yes	Yes	Yes	Yes
Create/edit traces, datasets, queues	Yes	Yes	Yes	No
Manage organization settings	Yes	Yes	No	No
Invite and manage members	Yes	Yes	No	No
Manage Owners and Admins	Yes	No	No	No
Access all workspaces automatically	Yes	Yes	No	No
Manage billing	Yes	Yes	No	No
Create/delete workspaces	Yes	Yes	No	No

Workspace Action	Workspace Admin	Workspace Member	Workspace Viewer
View workspace resources	Yes	Yes	Yes
Create/edit resources	Yes	Yes	No
Manage workspace members	Yes	No	No
Invite users to workspace	Yes	No	No

---

FAQ