Docs/Administration

Roles

Access in Vaurd is controlled by roles. This page explains how access works and what each role can do.

How access works

Access is controlled at two levels, and every member has both:

Organization roles, which control what a member can do across the whole organization (for example, managing members, sources, events, integrations, or agents).
A workspace access level, granted per workspace, which controls what a member can do with the flows inside that workspace.

The two levels are independent. Apart from the organization Owner, who can work on the flows in every workspace, a member's organization role does not, by itself, give them access to any workspace's flows, and a member's access in one workspace says nothing about their access in another. What someone can actually do is the combination of their organization roles and their access in each workspace they belong to.

For example, a member can be a Member at the organization level (so they cannot manage org settings or invite other members), hold Owner access in the Payments workspace (so they can build, edit, and publish flows there), and have no access to the Orders workspace (so they cannot see its flows).

To invite members or change roles, see Team (for organization roles) and Workspaces (for workspace access).

Organization roles

A member can hold more than one organization role. Their effective permissions are the union of every role they hold, so adding a role can only widen access, never narrow it.

Roles are arranged so that the broader ones already cover the narrower ones:

Owner covers every other role.
Admin covers Agent Manager, Workspace Manager, and Member, but not Billing Manager. Admin and Billing Manager can therefore be held together.
Agent Manager, Workspace Manager, and Billing Manager each cover Member and can be combined with one another.

In Settings → Team, selecting a broader role automatically ticks the roles it covers and shows them as inherited. Every member is at least a Member.

Owner has full access to the organization, including billing, members, workspaces, sources, events, integrations, and agents. Owners can manage every workspace the way a Workspace Manager can: creating and updating workspaces, and adding or removing members in any workspace. Owners also have full access to the flows in every workspace (view, create, edit, delete, and publish) without needing a workspace access level. Only Owners can make another member an Owner, remove the Owner role from a member, or remove an Owner from the organization. An organization must always keep at least one Owner.
Admin has full access to the organization except billing. Admins can manage members, workspaces, sources, events, integrations, and agents, and can manage every workspace the way a Workspace Manager can: creating and updating workspaces, and adding or removing members in any workspace. Admins do not have access to a workspace's flows by default; flow access is granted per workspace. Admins cannot grant or remove the Owner role, and cannot remove an Owner from the organization.
Member is the baseline every member has. Members can view organization-wide, non-sensitive information such as event schemas, source metadata (never credentials), integrations, and agents, but cannot create or change any of it. Everything else a member can do comes from the workspaces they are given access to. A member with no workspace access cannot see any workspace or its flows.
Workspace Manager manages workspaces and their membership across the organization. They can create, update, and delete workspaces and add or remove workspace members. They can view the organization's member list so they can add people to workspaces, but do not manage organization settings, members, sources, events, integrations, agents, or billing.
Agent Manager manages the agent lifecycle: creating, registering, and re-registering agents, regenerating an agent's configuration and license keys, viewing registration logs, and viewing the agent dashboard. Agent Managers can also create events, because an agent's ingestion endpoints are defined by events. They cannot manage sources, integrations, members, or workspaces, and cannot create or publish flows.
Billing Manager is reserved for billing access. Billing screens are not yet available in the product, so today this role adds nothing beyond the Member baseline. It does not give access to workspaces or flows, and does not allow creating, updating, or deleting anything.

Organization role permissions

The tables below show what each organization role can do, action by action, for each resource. Roles that cover another role also get everything in that role's row, so an Admin has every Yes listed for Agent Manager, Workspace Manager, and Member as well.

Organization

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View settings	Yes	Yes	No	No	No	No
Rename	Yes	Yes	No	No	No	No
Delete	Yes	Yes	No	No	No	No

Every member can open Settings → Organization to see the organization's basic details and to leave the organization. Renaming and deleting are limited to the roles marked above.

Workspaces

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	No	Yes	No	No
Create	Yes	Yes	No	Yes	No	No
Update	Yes	Yes	No	Yes	No	No
Delete	Yes	Yes	No	Yes	No	No
Manage members	Yes	Yes	No	Yes	No	No

Members

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	No	Yes	No	No
Create (invite, approve join requests)	Yes	Yes	No	No	No	No
Update (change roles)	Yes	Yes	No	No	No	No
Delete (remove)	Yes	Yes	No	No	No	No

Events

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	Yes	Yes	Yes	Yes
Create	Yes	Yes	No	No	Yes	No
Update	Yes	Yes	No	No	No	No
Delete	Yes	Yes	No	No	No	No

Sources

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	Yes	Yes	Yes	Yes
Create	Yes	Yes	No	No	No	No
Update	Yes	Yes	No	No	No	No
Delete	Yes	Yes	No	No	No	No

Integrations

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	Yes	Yes	Yes	Yes
Create	Yes	Yes	No	No	No	No
Update	Yes	Yes	No	No	No	No
Delete	Yes	Yes	No	No	No	No

Agents

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	Yes	Yes	Yes	Yes
Create	Yes	Yes	No	No	Yes	No
Update	Yes	Yes	No	No	Yes	No
Delete	Yes	Yes	No	No	Yes	No
Register and re-register	Yes	Yes	No	No	Yes	No

Viewing an agent includes its registrations, registration logs, plugins, sources, and downtime. Analytics, flows, and executions for an agent are part of the agent dashboard.

Agent dashboard

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	Yes	No	No	Yes	No

Flows

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View, create, edit, delete, and publish in every workspace	Yes	No	No	No	No	No

For every role except Owner, flow access comes from a workspace access level (see Workspace access levels).

Billing and invoices

Action	Owner	Admin	Member	Workspace Manager	Agent Manager	Billing Manager
View	Yes	No	No	No	No	Yes
Update	Yes	No	No	No	No	Yes

Registering and re-registering an agent is available to Owners, Admins, and Agent Managers.

Only Owners can grant or remove the Owner role, or remove an Owner from the organization. Admins can change every other role.

Managing a workspace includes managing its members. Owners, Admins, and Workspace Managers can add and remove members in any workspace. Flows live inside workspaces, so access to a workspace's flows comes from a workspace access level (see below), not from an organization role. The one exception is the organization Owner, who has full access to the flows in every workspace.

Workspace access levels

Workspace access is granted per workspace. A member can have a different level in each workspace they belong to. There are three assignable levels.

Owner has full control of the workspace. A Workspace Owner can rename and delete the workspace, add and remove its members and change their access level, and create, edit, delete, and publish flows in it. Whoever creates a workspace becomes its Owner.
Contributor can build flows but not manage the workspace. A Contributor can create and edit flows, including saving new versions of them, but cannot delete or publish flows, and cannot manage members.
Reader has view-only access. A Reader can view the workspace and its flows but cannot create, edit, delete, or publish them. Reader is the level a new member gets when no other level is chosen.

Organization Owners, Admins, and Workspace Managers can manage any workspace and its members. Organization Owners can also work on the flows in every workspace. For Admins and Workspace Managers, managing a workspace does not grant access to its flows: to work on a workspace's flows, they need a workspace access level in that workspace. Because these roles can manage workspace membership, they can add themselves to a workspace to gain flow access.

Workspace access permissions

Applies only inside an assigned workspace. Organization Owners have every capability in this table in every workspace, whatever their access level.

Capability	Owner	Contributor	Reader
View the workspace	Yes	Yes	Yes
View flows	Yes	Yes	Yes
Create and edit flows	Yes	Yes	No
Delete flows	Yes	No	No
Publish flows	Yes	No	No
Rename the workspace	Yes	No	No
Delete the workspace	Yes	No	No
Manage workspace members	Yes	No	No

Viewing events, sources, and integrations comes from an organization role, not from a workspace access level. Every member can view them.

Workspaces

Agent management