Roles

This is the full matrix of who can do what in the console. Rows follow the rail; columns are the five tenant roles and the platform administrator. The management API applies the same rules to every request, so a role refused here is refused over the API too. Why the roles are shaped this way is in Roles and permissions.

How to read a cell:

Manage: open the view and change what it holds.
Use: open it and do the job it is for, without managing it.
Read: open it and change nothing.
No: the view is not in this role’s rail, and the API refuses it.

A platform administrator holds every permission in every tenant, plus the Platform section.

Workspace

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Overview	Use	Use	Use	Use	Use	Use
My conversations	Use	Use	Use	Use	No	Use

Use cases

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Code Assistant	Manage: settings, code sources, webhooks, review tokens; spend per developer; and everything a Builder does	Use: own developer keys and usage, code search, Ask, reviews	No	No	Read: settings, sources, reviews, spend per developer	Manage
Security	Manage: code assessments, findings, investigations, log sources, alerts, hunts; approves or rejects proposed actions	Use: starts code assessments, updates findings	No	No	Read: everything, including investigations	Manage

Build

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Models	Manage: deploy and undeploy for the tenant	Read	No	No	Read	Manage, plus adding to and removing from the catalog
Knowledge (collections, vector databases, pipelines)	Manage	Manage	No	No	Read	Manage
Agents	Manage, and preview	Manage, and preview	No	No	Read	Manage
Tools	Manage	Manage	No	No	Read	Manage
Skills	Manage	Manage	No	No	Read	Manage
Assistants	Manage, publish, and create share links	Manage and publish; no share links	No	No	Read	Manage
Playground	Use	Use	No	No	No	Use

Operate

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Runs	Read	Read	No	No	Read	Read
Approvals	Use: reads arguments, approves and rejects	No	No	Use: reads arguments, approves and rejects	Read, without the arguments	Use
Conversations	Read every conversation	Read every conversation	No	Read assistant conversations, without traces	Read every conversation	Read
Traces	Read	Read	No	No	Read	Read
Overview (observability)	Read	Read	No	No	Read	Read

Evaluate

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Review queue	Use: records judgments	No	No	Use: records judgments	Read	Use
Scores	Read	No	No	Read	Read	Read

Govern

View	Admin	Builder	End user	Reviewer	Auditor	Platform admin
Guardrails	Manage	Manage	No	No	Read	Manage
Users	Manage: invite, change roles, disable, temporary passwords	No	No	No	Read	Manage
Keys and budgets	Manage keys, project and key budgets	Read budgets; no keys	No	No	Read	Manage, including tenant and model budgets
Usage	Read	Read	No	No	Read	Read
Audit	Read, verify and export	No	No	No	Read, verify and export	Read, verify and export
Erasure	Manage: erase a person	No	No	No	Read	Manage

Everyone

View	Who
Profile (language, theme, display name)	Every role
Notifications	Every role
Command palette	Every role; it offers only what the role can open

Platform

Platform administrators only. No tenant role opens any of these.

Group	Views
Infrastructure	Clusters, System health
Model serving	Model registry, Runtimes
Customers	Tenants, Projects
Billing
Settings

Notes

One role per person, per tenant. A person’s role is read from the token your identity provider issues; a change applies when their session refreshes.
No role, no console. A signed-in account with no tenant role sees one screen saying so.
API keys hold no role. A key is limited by its project, its model allow-list and its budgets. See Keys, budgets and metering.
The roles’ names in the identity provider are ADMIN, BUILDER, MEMBER (shown as End user), REVIEWER and AUDITOR, and platform-admin for the platform administrator. See Identity and sign-in.