Workspace permissions

For operations tied only to the workspace, whether they're allowed is determined by the user's workspace role.

Operations

"Required permission" is the item and level shown under Permissions for a role. Workspace Owners have every permission. Users with a custom role can perform an operation when their role includes that permission. Operations marked "All members" can be performed regardless of the role's permissions. Operations marked "Workspace owners only" can't be performed with a custom role.

In the "Built-in role" column, "X or higher" means that role and any higher role can perform the operation. For the definition of the hierarchy, see Role hierarchy.

Operation	Category	Required permission	Built-in role
Inviting and removing users / changing a user's role (except Workspace Owners)	Users	Members: Manage	Workspace Owner
Creating, editing, and deleting service accounts	Users	Members: Manage	Workspace Owner
Granting and revoking the Workspace Owner role	Users	Workspace owners only	Workspace Owner
Inviting guests from reports	Users	Guest invitations: Invite	Workspace Editor or higher
Viewing sign-in methods	Users	Workspace settings: Edit	Workspace Owner
Switching to any service account	Users	Workspace owners only	Workspace Owner
Viewing audit logs	Audit logs	Audit logs: View	Workspace Owner
Viewing Agent usage	Codatum AI	Workspace settings: Edit	Workspace Owner
Managing all AI profiles	Codatum AI	Workspace owners only	Workspace Owner
Connecting Slack integrations / creating agent connectors / managing all external integrations	External integrations	External integrations: Manage	Workspace Owner
Viewing agent connector member connections	External integrations	Workspace settings: Edit	Workspace Owner
Viewing information about the workspace	Workspace	All members	Workspace Viewer or higher
Changing workspace settings (including security, AI settings, and PAT management; excluding policies, plan changes, and API keys)	Workspace	Workspace settings: Edit	Workspace Owner
Deleting the workspace / managing API keys / changing workspace policies	Workspace	Workspace owners only	Workspace Owner
Creating, editing, and deleting roles / changing guest invitations for Editor	Workspace	Workspace owners only	Workspace Owner
Viewing information for all groups	Group	All members	Workspace Viewer or higher
Creating a group / managing all groups	Group	Groups: Manage	Workspace Owner
Creating a connection	Connection	Create and manage connections: Create	Workspace Editor or higher
Managing every connection whose access level is Workspace or Protected	Connection	Create and manage connections: Manage	Workspace Owner
Creating a teamspace	Teamspace	Create and manage teamspaces: Create	Workspace Editor or higher
Managing all teamspaces	Teamspace	Create and manage teamspaces: Manage	Workspace Owner
Creating and editing tag definitions	Tag	Tag definitions: Edit	Workspace Editor or higher
Creating a workflow	Workflow	Workflows: Create	Workspace Editor or higher
Managing workflows	Workflow	Workflows: Manage	Workspace Owner

Inviting guests from the report screen requires the Guest invitations permission in addition to the report permissions. You can remove the guest invitation permission from Workspace Editor (Changing guest invitations for Editor). For details, see Report permissions and Invitations and joining.

Whether you can manage billing or change the plan isn't determined by the workspace role. It's determined by whether you are an organization owner. For details, see Members and Workspace subscriptions.

Editing or deleting a group, and changing its members, can be done by users with the Groups manage permission as well as the Group Owner. For details, see Group.

For operations tied to resources such as connections, notebooks, and reports, see Permissions overview and the page for each resource.