Every member of an organization holds exactly one role. Five roles build on each other: each one can do everything the role below it can, plus what its own section lists. The sixth role, BillingManager, stands on its own and covers billing only.
| Role | What it is for | Uses a seat |
|---|---|---|
| Reader | Reading, and consuming in CI | yes |
| Contributor | Writing drafts, starting spec runs | yes |
| Editor | Publishing and retracting versions | yes |
| Manager | Running the organization: members, settings, domains, integrations | yes |
| Owner | Full control including billing, export, and deletion | yes |
| BillingManager | Billing only | no |
Assigning roles
You assign roles on the Members tab of your organization's settings. You can grant any role up to your own level: a Manager grants up to Manager, and granting Owner takes an Owner. Anyone who may manage members can grant BillingManager.
An organization always has at least one Owner. The last remaining Owner can neither be removed nor demoted.
Reader
The baseline every member has.
- View rules and profiles, including versions, diffs, and search.
- Download bundles, resolve profiles, and verify lockfiles. That is enough for a CI runner.
- View spec-run results and the history of AI runs.
- See the member list.
- Create and revoke their own API keys.
- Download a license and authorize their own device.
- View the organization's telemetry and insights dashboards.
Contributor
Everything a Reader can do, plus:
- Create, change, and delete rule and profile drafts.
- Start spec runs and re-runs, and cancel their own runs.
- Generate rules with AI. This consumes the organization's AI quota.
This is how you separate proposing from publishing: a Contributor drafts, an Editor reviews and publishes.
Editor
Everything a Contributor can do, plus:
- Publish rule and profile versions.
- Archive rules and mark them deprecated.
- Archive profiles and rename their slug before the first publication.
- Retract published rule and profile versions, and undo the retraction.
Manager
Everything an Editor can do, plus:
- Invite members and revoke pending invitations.
- Remove members and change their roles.
- Grant roles up to their own level.
- Read and change the organization's settings, including notifications.
- Claim, verify, and remove domains, see Domain verification.
- Link the GitHub installation and configure badges and CI checks.
- Read and export the organization's audit log.
- View invoices, the current plan, and seat usage.
- Cancel spec runs started by other members, for example when the queue is stuck.
Owner
Everything a Manager can do, plus:
- Manage billing: checkout, plan switch, cancellation, and payment method.
- Export all of the organization's data, meaning rules, profiles, and the audit log, as an archive.
- View and revoke every API key in the organization, not just their own.
- View, reissue, and revoke every license issued in the organization.
- Archive or delete the organization.
BillingManager
The bookkeeping role. It covers exactly three things:
- View invoices, the current plan, and seat usage.
- Manage billing: checkout, plan switch, cancellation, and payment method.
- See the member list, to follow which seats are being paid for.
Access ends there: rules, profiles, bundles, spec runs, AI generation, and licenses stay out of reach. That is exactly why BillingManager is the only role that uses no seat. It fits the person who looks after the company card but does not work on the code.
Roles and seats
Every role except BillingManager uses a seat of your plan, even when the member only ever reads. An external reviewer with the Reader role therefore counts the same as an Owner. The Billing tab of your organization's settings shows how many seats your plan includes and how many are in use.