# Roles (/docs/organizations/roles)

Every member of an Organization has one **role**, the same in every product: **admin**, **developer**, **editor** or **reader**. Admins set it on the Organization's **People** tab. What a role may do is decided by each product, along the same lines:

- **Readers** see everything they have access to, and change nothing.
- **Editors** do the daily work: tests and flags, entries and files.
- **Developers** also connect sites: the content model, API tokens, webhooks, allowed origins, deployments and Spaces.
- **Admins** also manage the Organization: its people, products, billing, and transferring or deleting Spaces.

An admin can narrow this down per member: keep them out of a product, or give them a role in some Spaces only. See [Product access](/docs/organizations/product-access).

## The Organization (www) [#the-organization-www]

| May…                                                                    | Admin | Developer | Editor | Reader |
| ----------------------------------------------------------------------- | :---: | :-------: | :----: | :----: |
| See the Organization, its Spaces, its members and its products          |   ✓   |     ✓     |   ✓    |   ✓    |
| Create a Space, rename one                                              |   ✓   |     ✓     |        |        |
| Allowed origins, connected deployments and the Shopify store of a Space |   ✓   |     ✓     |        |        |
| Invite people, change roles and product access, remove members          |   ✓   |           |        |        |
| Switch Improve or Content on or off                                     |   ✓   |           |        |        |
| Billing                                                                 |   ✓   |           |        |        |
| Rename or delete the Organization                                       |   ✓   |           |        |        |
| Delete a Space; transfer one (as an admin of both Organizations)        |   ✓   |           |        |        |

## Improve [#improve]

| May…                                                   | Admin | Developer | Editor | Reader |
| ------------------------------------------------------ | :---: | :-------: | :----: | :----: |
| See tests, flags, audiences and results                |   ✓   |     ✓     |   ✓    |   ✓    |
| Create, change, start, stop and delete tests and flags |   ✓   |     ✓     |   ✓    |        |
| Settings and API tokens                                |   ✓   |     ✓     |        |        |

## Content [#content]

| May…                                                    | Admin | Developer | Editor | Reader |
| ------------------------------------------------------- | :---: | :-------: | :----: | :----: |
| Read content, the model and assets; comment             |   ✓   |     ✓     |   ✓    |   ✓    |
| Create, save, publish and delete entries; upload assets |   ✓   |     ✓     |   ✓    |        |
| Change the content model, locales and Settings          |   ✓   |     ✓     |        |        |
| API tokens and webhooks                                 |   ✓   |     ✓     |        |        |
| Reviewed publishing: turn it on, and approve reviews    |   ✓   |           |        |        |
| Roles per Space; registering plugins                    |   ✓   |           |        |        |

Where an environment's publishing is **reviewed**, only admins publish there; developers and editors ask for a review. [Content's roles](https://content.obelism.studio/docs/guides/roles) has the full list.

## Numbers [#numbers]

| May…                                     | Admin | Developer | Editor | Reader |
| ---------------------------------------- | :---: | :-------: | :----: | :----: |
| See every report                         |   ✓   |     ✓     |   ✓    |   ✓    |
| Save funnels                             |   ✓   |     ✓     |   ✓    |        |
| Delete events; API tokens; set up a site |   ✓   |     ✓     |        |        |

## Media [#media]

| May…                                        | Admin | Developer | Editor | Reader |
| ------------------------------------------- | :---: | :-------: | :----: | :----: |
| Open and download files                     |   ✓   |     ✓     |   ✓    |   ✓    |
| Upload, change and delete files and folders |   ✓   |     ✓     |   ✓    |        |

Media follows Content: a member kept out of Content is kept out of Media too.

## Safeguards [#safeguards]

- **An Organization always has an admin.** The last admin can't be removed or made something else: make someone else admin first.
- **Nobody changes their own role** on the People tab. Ask another admin.
- **A role is per Organization.** Someone can be an admin of their own Organization and a reader in a client's.
- **Role changes apply at once**, in every product, to the person, their agents and the tokens they made.

## Tokens and agents act as a person [#tokens-and-agents-act-as-a-person]

- An agent connected through the [MCP server](/docs/agents/mcp), and ⌘K, act as the person who connected them, with that person's role at the time of each call. Change the role and the agent can do less at once. See [What an agent may do](/docs/agents/permissions).
- Content's management tokens act as the person who made them; they stop working when that person leaves the Organization.
- Delivery, preview and the other products' API tokens belong to a Space's environment, not to a person, and only do what their kind allows.

## Platform staff [#platform-staff]

Obelism's own staff approve the invite codes new Organizations are created with. That is not a role in your Organization, and not one you can give.