# Users and roles Understand organization and workspace roles in Tracix, build custom roles from 52 permission surfaces, and see what each role can do. Tracix has two kinds of roles. An **organization role** decides what someone can do in the console. A **workspace role** decides what they can do inside one workspace. Custom roles add permissions from the same catalog on top of the built-in roles. ## Organization roles You manage organization roles in the console under **Team**. | Role | What it can do | How someone gets it | | ------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | | Owner | Everything, including the actions reserved for the Owner, such as assigning the Owner role | Creating the organization at sign-up | | Admin | All organization administration: members, roles, workspaces and their access, single sign-on, SCIM, security policy and billing | An invite, or single sign-on | | Member | Sees the organization's workspaces in the console. What they can do inside a workspace depends on their workspace role | An invite, or single sign-on | | MSP admin | The same permissions as Admin, for managed service providers | Single sign-on only, through your SSO settings | | MSP viewer | Read-only access to the organization's console pages | Single sign-on only, through your SSO settings | | A custom role | The Member baseline plus the permissions you choose | An invite | The **Roles & permissions** tab on **Team** lists the built-in roles with their permission counts, and your custom roles. ## Workspace roles Each person's access to a workspace is set on that workspace's **Access** tab in the console. Nobody can open a workspace without a workspace role, organization Admins included; the person who creates a workspace starts as its Admin. | Role | Permissions | | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Every workspace permission, including the `manage`, `apply` and `approve` actions | | Editor | Every `read` and `write` permission: build dashboards and monitors, edit policies and devices, and run queries. No `manage`, `apply` or `approve` actions | | Viewer | Every `read` permission, plus their own profile, such as Brain memory notes | The `manage`, `apply` and `approve` actions are the ones only a workspace Admin holds, unless a custom role grants them. They cover managing collectors, integrations, discovery, APM, RUM, security, log pipelines, on-call, notification channels, workflows, Auto-Fix, AI settings, credentials, data lifecycle and workspace settings, approving Auto-Fix changes, and applying and approving network configuration changes. ## Custom roles A custom role is a named set of permissions, such as "logs and monitors only" or "read-only APM". Someone with a custom role gets the Member baseline plus exactly the permissions you pick. ### Create a custom role **1. Open the roles tab** In the console, open **Team**, select the **Roles & permissions** tab and select **Create role**. **2. Name it** Enter a **Name** of 2 to 40 characters, such as `Support engineer`, and an optional description of up to 200 characters. The name can't be a built-in role's name. **3. Choose permissions** Permissions are grouped under **Organization**, for console pages, and **Workspace**, for product pages inside a workspace. **Toggle all read** selects every `read` permission in a group. Select **Create role**. **4. Assign it** Choose the role in **Invite member** when you invite someone. How custom roles work: * **Organization permissions are read-only.** Administering the organization, its members, roles, workspaces, billing, single sign-on, API keys and feature flags stays with Admins, so a custom role can never widen itself. * **Workspace permissions add to the workspace role.** They apply in every workspace the person can open, on top of their role there. They don't give access to a workspace on their own. * **Editing and deleting.** Edit a role with the pencil icon. A role assigned to members or pending invites can't be deleted until you reassign them. * An organization can have up to 50 custom roles. > **Single sign-on replaces custom roles** > > If your organization uses single sign-on, each SSO sign-in sets the person's organization role from your default role and group mappings and removes any custom role. Owners keep their role. See [Single sign-on](https://tracix.io/docs/admin/sso). ## Change someone's role * **Workspace role**: on the workspace's **Access** tab, choose a new role from the menu on the person's row. * **Organization role**: not yet in the console. The **Team** page shows each member's role but has no role editor. Today, remove the member and invite them again with the new role, or, with single sign-on, change their groups in your identity provider; the new role applies at their next sign-in. ## Permission reference {/* Evidence: 52 surfaces (44 workspace, 8 organization) in tracix-cloud src/lib/authz/catalog.ts on main, identical to tracix-app lib/authz/catalog.ts. Re-check before launch. */} Every permission is a surface and an action, such as `monitors.write`. The catalog has 52 surfaces: 44 inside a workspace and 8 in the organization. ### Workspace surfaces | Actions | Surfaces | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `read` | `overview`, `network_flows`, `bgp`, `sdwan`, `topology`, `databases`, `endpoint_experience`, `hosts`, `containers`, `kubernetes`, `cloud_assets`, `logs`, `traces` | | `read`, `write` | `policies`, `network_devices`, `synthetics`, `metrics`, `visualizations`, `dashboards`, `monitors`, `alerts`, `incidents`, `slos`, `downtimes`, `correlation_rules`, `ml_anomaly`, `variables`, `profile` | | `read`, `manage` | `collectors`, `integrations`, `discovery`, `apm`, `rum`, `security`, `log_pipelines`, `oncall`, `notification_channels`, `ai_settings`, `credentials`, `workspace_settings` | | `read`, `write`, `apply`, `approve` | `ncm` | | `read`, `write`, `manage` | `workflows` | | `read`, `write`, `manage`, `approve` | `autofix` | | `read`, `manage`, `apply` | `data_lifecycle` | ### Organization surfaces | Surface | Actions | Covers | | --------------- | ------------------------------------ | ---------------------------------------------------------- | | `deployments` | `read`, `create`, `manage`, `delete` | Workspaces: listing, creating, access and lifecycle | | `organization` | `read`, `manage` | Organization settings and security policy | | `team` | `read`, `manage` | Members, invites and roles | | `billing` | `read`, `manage` | Plan, usage, invoices and payment | | `api_keys` | `read`, `manage` | Organization-level API keys. No console page uses it yet | | `sso` | `read`, `manage` | Single sign-on and SCIM | | `audit_log` | `read` | The organization's audit log. No console page shows it yet | | `feature_flags` | `read`, `manage` | Feature flags. No console page uses it yet | ## Next steps - [Invite your team](https://tracix.io/docs/get-started/invite-your-team): Invite people and grant workspace access - [Single sign-on](https://tracix.io/docs/admin/sso): Map identity provider groups to roles - [API keys and ingest keys](https://tracix.io/docs/admin/api-keys): Give machines scoped access