Each person in an organization has one role. It applies in the dashboard, the REST API, the OpenTofu CLI, and AI agents they connect.
Roles
| Role | Who it’s for | Access |
|---|---|---|
| Owner | The people accountable for the organization | Everything, including making other members owners. Owners can’t be removed or demoted from the dashboard. |
| Admin | Platform and infrastructure leads | Everything, including members, credentials, policies, and approvals. |
| Member | Engineers who propose changes | Read most things and start runs. Can’t approve, apply, or change settings. |
Custom roles and teams aren’t available. To change someone’s role, see Members and invitations.
What each role can do
| Action | Member | Admin and owner |
|---|---|---|
| View projects, workspaces, runs, plans, and logs | Yes | Yes |
| View state outputs | Yes | Yes |
| View policies, the module registry, GitHub settings, and credential metadata | Yes | Yes |
| Start runs | Yes | Yes |
| Approve, reject, or cancel runs | No | Yes |
| Create and edit projects and workspaces | No | Yes |
| Manage workspace variables | No | Yes |
| Download raw state or sensitive run artifacts | No | Yes |
| Recover an interrupted apply | No | Yes |
| Manage cloud credentials and workspace tokens | No | Yes |
| Publish and attach policies | No | Yes |
| Override a soft-mandatory policy | No | Yes |
| Publish and manage registry modules | No | Yes |
| Install the GitHub App and connect repositories | No | Yes |
| Invite members, change roles, and view the audit log | No | Yes |
Permissions for tokens
Workspace tokens don’t use roles. Each token has fixed permissions for its purpose, is limited to one workspace, and never has more access than the person who created it.