Roles and Rights

Operaide uses role-based access control to determine what each user can see and do. Every action in the platform — viewing a Reaktor, editing an AI provider, inviting a member — is governed by permissions, and permissions are granted through roles.

How Roles Work

Roles in Operaide fall into two categories:

• Organization roles are scoped to a specific organization. A user can hold different roles in different organizations. These roles control what the user can do within that organization — managing apps, viewing reports, inviting members, and so on.
• Global roles apply system-wide, regardless of which organization the user is currently in. These are reserved for platform-level administrators and are not part of day-to-day organization management.

Roles follow a hierarchy: when you hold a higher-level role, you automatically receive the capabilities of every role it includes. For example, an App Manager can do everything an App Developer can do, plus management actions. You never need to assign both roles — the higher one is sufficient.

Organization Roles

These are the roles you work with as an organization administrator. Each role grants a specific set of capabilities within the organization.

Role	Description	Includes
Organization Member	Basic membership. Use chat, access the API, and interact with Reaktor instances. This is the minimum role for any organization member.	—
App Developer	Read-only access to apps, Reaktors, AI providers, and connections. Can view the App Store and access Reaktor logs, but cannot create or modify anything.	Organization Member
App Manager	Full management of apps and Reaktor instances within the organization. Can create, edit, and delete Reaktor instances, manage the App Store, and manage agent databases.	App Developer
Member Manager	Manage members within the organization. Can invite new members, change roles, and remove members.	Organization Member
Credential Manager	Manage connections and AI provider configurations within the organization. Can create, edit, and delete both connections and AI providers.	Organization Member
Reporting Manager	View usage statistics and Reaktor performance reports for the organization.	Organization Member
Administrator	Full organization management. This is a convenience role that combines all manager roles into one. When you invite a user as "Administrator", they receive Member Manager, App Manager, Credential Manager, and Reporting Manager capabilities.	All manager roles

tip

The Administrator role is what you see when inviting new members. It bundles all organization management roles so you do not have to assign them individually.

Global Roles

Global roles are managed by system-level administrators and apply across all organizations. Most organization administrators do not interact with these roles directly.

Role	Description
Super Administrator	The highest privilege in Operaide. Full control over all organizations, all users, and all system settings.
System Administrator	System-level administrative access across all organizations. Automatically includes all organization management roles.
Internal Developer	Internal team member with developer-level system access. Used for platform development and debugging.

Super Administrator and System Administrator use an activation pattern for safety. Users are first assigned a "Can Become" role (e.g., "Can Become Super Admin"), which makes them eligible but does not grant elevated privileges immediately. The user must explicitly activate admin mode through a toggle in the interface. This prevents accidental use of elevated privileges during routine work.

Role Hierarchy

Roles form a hierarchy where higher roles automatically include the capabilities of lower roles. You never need to assign a role and its included roles separately — the higher role is sufficient.

Super Administrator
  └── System Administrator
        ├── Member Manager ──── Organization Member
        ├── App Manager ──── App Developer ──── Organization Member
        ├── Credential Manager ──── Organization Member
        └── Reporting Manager ──── Organization Member

This hierarchy also governs who can modify whose roles:

• A Super Administrator can modify any user.
• A System Administrator can modify anyone except Super Administrators.
• A Member Manager can modify anyone except Super Administrators and System Administrators.

You cannot escalate your own privileges or modify users who hold higher roles than you.

Assigning Roles

Inviting a New Member

1. Navigate to Organization Settings > Members.
2. Enter the email address of the person you want to invite.
3. Select a role: Member (basic access) or Administrator (full organization management).
4. Click Invite. An invitation email is sent to the specified address.

The invited user receives Organization Member or Administrator privileges once they accept the invitation.

Changing an Existing Member's Role

1. Navigate to Organization Settings > Members.
2. Find the user in the member list.
3. Use the role toggle action to switch between Organization Member and Member Manager.

warning

You cannot change the role of users who hold higher global privileges than you. For example, a Member Manager cannot modify the roles of System Administrators or Super Administrators.

Composite Roles

Operaide supports composite roles — custom role templates that bundle multiple organization roles into a single assignable role. Composite roles are created by the Application Owner Organization and are available across all organizations. For example, a composite role called "Data Scientist" could combine App Developer and Reporting Manager into one role. When assigned to a user, the system automatically expands the composite role into its component roles during permission checks.

Permissions and Feature Flags

Each feature in Operaide defines specific permissions that map to one or more roles. When you access a feature, the platform checks whether your current roles (including all implied and composite roles) grant the required permission.

Some permissions additionally require a feature flag to be enabled for your organization. Even if you hold the correct role, the feature may not be available until a system administrator enables the corresponding feature flag.

You can find the specific permissions required for each feature in the "Permissions" section at the bottom of the respective documentation page. For an example, see the AI Provider page.