Roles matrix

What each role can do, using platform default organization settings.

How to read the matrix

A person can hold several roles; an organization role applies across all workspaces. “n/a” means the action does not apply to that principal. Cells marked * depend on a setting (see Known issues and hardening). Role definitions are in the permissions reference. The default permissions of each workspace role, and where an admin changes them, are in Roles.

Organization and workspaces

Action	Org owner	Org admin	Org member	Workspace viewer	Workspace member	Workspace admin or owner	Agent	Applet
Invite or remove organization members	Yes	Yes, except owners	No	No	No	No	Only with an admin role (P-07)	No
Change organization roles	Yes	Up to admin	No	No	No	No	Only with an admin role (P-07)	No
Change organization settings	Yes	Yes	No	No	No	No	No	No
View and delete all sandboxes in the deployment (infrastructure page)	Yes * (P-09)	Yes * (P-09)	No	No	No	No	No	No
Create a workspace	Yes	Yes	Yes (setting)	n/a	n/a	n/a	No	No
Delete a workspace	Yes	Yes	No	No	No	No	No	No
Manage workspace members	Yes	Yes	No	No	No	Yes	Only with an admin role (P-07)	No

The infrastructure page rows apply only when Show Organization Infrastructure Page is on (off by default).

Files

Action	Org owner	Org admin	Org member	Workspace viewer	Workspace member	Workspace admin or owner	Agent	Applet
Read files in a workspace	All, including private *	All, including private *	Where a role is held	Yes	Yes	Yes	Own roles plus its owner’s file permissions	Bound folders
Write files	All	All	Where a role allows	No	Yes	Yes	As above	Bound folders, if granted
Share files	Yes	Yes	Where a role allows	No	No	Yes	As above	No
Read another person’s private drive directly	No	No	No	No	No	No	Its owner’s, read only	No

Tasks, agents and skills

Action	Org owner	Org admin	Org member	Workspace viewer	Workspace member	Workspace admin or owner	Agent	Applet
Create and run tasks	Yes	Yes	Organization-level tasks	No	Yes	Yes	n/a	n/a
Read other people’s tasks	Yes	Yes	Only if shared	Only if shared	Only if shared	Only if shared	n/a	n/a
Create agents	Yes	Yes	No (setting); personal assistants are created automatically	n/a	n/a	n/a	n/a	n/a
Configure or delete an agent	Yes	Yes	Own agents	No	No	Any agent in the workspace, including members’ assistants (P-06)	No	n/a
Run another person’s personal assistant	Yes	Yes	Yes * (P-01)	No	Yes *	Yes *	n/a	n/a
Edit, archive or change visibility of organization-visible skills	Yes	Yes	Yes, any (P-04)	No	Workspace skills	Workspace skills	Skills the task’s starter can edit, and skills shared to the agent	n/a

Connectors, applets and secrets

Action	Org owner	Org admin	Org member	Workspace viewer	Workspace member	Workspace admin or owner	Agent	Applet
Register a connector definition	Organization level	Organization level	Personal only	No	No	Workspace level	n/a	n/a
Create or publish applets	Yes	Yes	Yes	n/a	n/a	n/a	n/a	n/a
Approve applets for the organization	Yes	Yes	No	No	No	No	No	No
Create secrets	Yes	Yes	Personal or organization	No	Workspace	Yes	No	n/a
Use a secret	Its owner	Its owner	Its owner	Its owner	Its owner	Its owner	No	Secrets bound to it, through the application tier
Change a secret’s allowed hosts	Secrets they own, and applet-owned secrets	Secrets they own, and applet-owned secrets	Its owner	Its owner	Its owner	Its owner	No	No

Approvals, rules and audit

Action	Org owner	Org admin	Org member	Workspace viewer	Workspace member	Workspace admin or owner	Agent	Applet
Answer agent approval requests	Yes	Yes	For tasks they started	n/a	For tasks they started	For agents whose home workspace they administer	Never	n/a
Set allow, ask or deny rules on resources	Yes	Yes	No	No	No	Resource level	No	No
View audit events	Organization	Organization	Resources they can read	Resources they can read	Resources they can read	Workspace	n/a	n/a
Configure sign-in, models and feature settings	Setup operator only (setup password); no organization role grants this

A person can also obtain another person’s file access through that person’s personal assistant while P-01 is open.