Organizations
Roles
Admin, developer, editor and reader. What each role may do on www and in Improve, Content, Numbers and Media, and the safeguards around changing roles.
Every member of an Organization has one role, the same in every product: admin, developer, editor or reader. Admins set it on the Organization's People tab. What a role may do is decided by each product, along the same lines:
- Readers see everything they have access to, and change nothing.
- Editors do the daily work: tests and flags, entries and files.
- Developers also connect sites: the content model, API tokens, webhooks, allowed origins, deployments and Spaces.
- Admins also manage the Organization: its people, products, billing, and transferring or deleting Spaces.
An admin can narrow this down per member: keep them out of a product, or give them a role in some Spaces only. See Product access.
The Organization (www)
| May… | Admin | Developer | Editor | Reader |
|---|---|---|---|---|
| See the Organization, its Spaces, its members and its products | ✓ | ✓ | ✓ | ✓ |
| Create a Space, rename one | ✓ | ✓ | ||
| Allowed origins, connected deployments and the Shopify store of a Space | ✓ | ✓ | ||
| Invite people, change roles and product access, remove members | ✓ | |||
| Switch Improve or Content on or off | ✓ | |||
| Billing | ✓ | |||
| Rename or delete the Organization | ✓ | |||
| Delete a Space; transfer one (as an admin of both Organizations) | ✓ |
Improve
| May… | Admin | Developer | Editor | Reader |
|---|---|---|---|---|
| See tests, flags, audiences and results | ✓ | ✓ | ✓ | ✓ |
| Create, change, start, stop and delete tests and flags | ✓ | ✓ | ✓ | |
| Settings and API tokens | ✓ | ✓ |
Content
| May… | Admin | Developer | Editor | Reader |
|---|---|---|---|---|
| Read content, the model and assets; comment | ✓ | ✓ | ✓ | ✓ |
| Create, save, publish and delete entries; upload assets | ✓ | ✓ | ✓ | |
| Change the content model, locales and Settings | ✓ | ✓ | ||
| API tokens and webhooks | ✓ | ✓ | ||
| Reviewed publishing: turn it on, and approve reviews | ✓ | |||
| Roles per Space; registering plugins | ✓ |
Where an environment's publishing is reviewed, only admins publish there; developers and editors ask for a review. Content's roles has the full list.
Numbers
| May… | Admin | Developer | Editor | Reader |
|---|---|---|---|---|
| See every report | ✓ | ✓ | ✓ | ✓ |
| Save funnels | ✓ | ✓ | ✓ | |
| Delete events; API tokens; set up a site | ✓ | ✓ |
Media
| May… | Admin | Developer | Editor | Reader |
|---|---|---|---|---|
| Open and download files | ✓ | ✓ | ✓ | ✓ |
| Upload, change and delete files and folders | ✓ | ✓ | ✓ |
Media follows Content: a member kept out of Content is kept out of Media too.
Safeguards
- An Organization always has an admin. The last admin can't be removed or made something else: make someone else admin first.
- Nobody changes their own role on the People tab. Ask another admin.
- A role is per Organization. Someone can be an admin of their own Organization and a reader in a client's.
- Role changes apply at once, in every product, to the person, their agents and the tokens they made.
Tokens and agents act as a person
- An agent connected through the MCP server, and ⌘K, act as the person who connected them, with that person's role at the time of each call. Change the role and the agent can do less at once. See What an agent may do.
- Content's management tokens act as the person who made them; they stop working when that person leaves the Organization.
- Delivery, preview and the other products' API tokens belong to a Space's environment, not to a person, and only do what their kind allows.
Platform staff
Obelism's own staff approve the invite codes new Organizations are created with. That is not a role in your Organization, and not one you can give.