Roles and permissions
See what owners, admins, and members can do in an organization.
Three organization roles
Your role applies to one organization. You can have a different role in another. Developers can actively work with data; Developer is not a read-only role.
| Capability | Developer | Admin | Owner |
|---|---|---|---|
| Run SQL; view and save queries | Yes | Yes | Yes |
| Create and manage captures, crawls, pins, schedules | Yes | Yes | Yes |
| View members, usage, and audit log | Yes | Yes | Yes |
| Create and revoke own API keys | Yes | Yes | Yes |
| Connect AI clients over MCP; revoke own connected apps | Yes | Yes | Yes |
| Invite and manage non-owner members | No | Yes | Yes |
| Grant or remove ownership | No | No | Yes |
Permission names
Permissions use organization:<resource>:read or :write. SQL has a separate exec permission: permission to view or save SQL is not the same as permission to execute it. The standard roles above include all three SQL permissions. API keys and MCP connections never exceed your current role; MCP connections are further limited to a fixed Agent profile without access management.
| Resource | Actions |
|---|---|
| sql | read, write, exec |
| captures, crawls, pins, schedules | read, write |
| members | read, write |
| api_keys | read, write; always limited to your own keys |
| usage, audit | read |
| owners | write |