Roles & permissions¶
Dezycro has two levels of access control, matching the tenant vs workspace split:
- Organization roles — one per user, covering org-wide concerns: billing, members, and the workspaces themselves.
- Workspace roles — one per workspace membership, covering the work inside a workspace: projects, tests, notebooks, and skills.
A user's effective access is the combination of both: whatever either role allows, they can do. In practice, organization Owners and Admins have full product access everywhere, while everyone else's day-to-day access is decided by their role in each workspace.
Access levels¶
The tables below use three levels:
- Manage — full control: create, configure, and delete, plus everything below
- Edit — create and modify content, but not delete or reconfigure the container it lives in
- View — read-only
Organization roles¶
| Owner | Admin | Member | Viewer | |
|---|---|---|---|---|
| Billing & plan | Manage | — | — | — |
| Organization settings (SSO, LLM configuration, audit logs) | Manage | — | — | — |
| Workspaces (create, configure, delete) | Manage | Manage | — | — |
| Members & invitations | Manage | Manage | — | — |
| Work inside workspaces | Manage | Manage | per workspace role | View |
- Owner — full control of the organization. The only role that can change billing, organization settings, and other users' organization roles. Usually the person who created the organization.
- Admin — runs the organization day to day: creates workspaces, invites and manages members. Cannot touch billing or organization settings.
- Member — the standard role. No organization-level powers; what they can do is decided entirely by their role in each workspace they belong to.
- Viewer — read-only across the organization. Viewers are always read-only in every workspace, regardless of workspace role, and don't consume a billable seat.
Workspace roles¶
Workspace roles are assigned per workspace — the same person can be an Admin in one workspace and a Viewer in another.
| Admin | Editor | Viewer | |
|---|---|---|---|
| Workspace settings & integrations (git connections, knowledge base imports) | Manage | — | — |
| Workspace members | Manage | — | — |
| Projects & features (PRDs, TRDs, flow maps) | Manage | Manage | View |
| Ship a feature without verification (Ship anyway) and un-ship | ✓ | — | — |
| Test cases & personas | Manage | Manage | View |
| Notebooks | Manage | Edit | View |
| Skills | Manage | Manage | View |
- Admin — owns the workspace: settings, integrations, and membership, plus everything an Editor can do. Admins are also the only role that can create, delete, or restructure notebooks.
- Editor — the default role for new members. Full day-to-day authoring: projects, features, test cases, notebook pages, and skills.
- Viewer — read-only access to everything in the workspace.
Common questions¶
Who can invite people? Organization Owners and Admins invite people into the organization; workspace Admins add existing members to their workspace.
Who can see billing? Only the organization Owner.
What happens when someone becomes an organization Viewer? All their workspace roles are automatically set to Viewer, and they stop counting toward your seat total.
Can a Member create workspaces? No — creating and deleting workspaces requires an organization Owner or Admin.
How quickly does a role change take effect? Usually within seconds, and within a minute at most. That holds for granting and revoking organization and workspace roles, for removing someone from a workspace, and for removing someone from the organization: their existing sessions and tokens stop working within that same minute. You don't need to ask anyone to sign out.
Do Personal Access Tokens have their own permissions? No. A PAT inherits the roles of the user who created it.