Roles & Permissions
Role-based access control (RBAC) lets you define custom roles and assign granular permissions to your team members. Available on the Enterprise plan.
When RBAC is on, every member's permissions come from their assigned role — a member without a role stays in the organization but reaches nothing through a role until one is assigned. Without RBAC, everyone who joins the organization is an Owner with full access, and Settings → Roles says "Roles aren't being applied" (see Team).
Switching RBAC resets roles
When RBAC is switched on or off for an organization, every member and every pending invitation is set to the Owner role, so everyone has full access – billing and deleting the organization included – until you assign narrower roles.
Permissions#
Twenty-one permissions, in three groups, make up every role. Settings → Roles shows them with these labels:
| Permission | Group | Grants |
|---|---|---|
Manage team (org:manage_team) | Organization | Invite and remove members, assign roles, and manage custom roles |
Manage billing (org:manage_billing) | Organization | View and change billing settings, payment methods, and invoices |
Manage settings (org:manage_settings) | Organization | Change the organization name, timezone, integrations, and feature flags |
Manage API keys (org:manage_api_keys) | Organization | Create, scope, and delete the organization's service API keys |
Manage integrations (org:manage_integrations) | Organization | Connect, configure, and disconnect external integrations |
Delete organization (org:delete) | Organization | Permanently delete the entire organization |
View audit logs (org:view_audit_logs) | Organization | Read the organization's audit trail. Needs the Audit Logs entitlement |
Manage reviews (org:manage_reviews) | Organization | View review history and statistics for internal translation reviews |
Manage decision pools (org:manage_decision_pools) | Organization | Create, rename, and archive decision pools, and choose their members |
View engines (engine:read) | Engines | View localization engines and their configuration |
Run translations (engine:translate) | Engines | Run localization jobs against the organization's engines |
Create engines (engine:create) | Engines | Create new engines in the organization |
Edit engines (engine:edit) | Engines | Edit engine configuration and model configs |
Delete engines (engine:delete) | Engines | Permanently delete engines |
Review translations (engine:review_translations) | Engines | Review AI translations in the internal review queue |
View glossaries (org:glossary:read) | Content | View the organization's glossaries and their terms |
Edit glossaries (org:glossary:edit) | Content | Create, change, and delete glossaries and terms, and apply them to engines |
View brand voices (org:brandvoice:read) | Content | View the organization's brand voices |
Edit brand voices (org:brandvoice:edit) | Content | Create, change, and delete brand voices, and apply them to engines |
View rules (org:ruleset:read) | Content | View the organization's rulesets and the rules inside them |
Edit rules (org:ruleset:edit) | Content | Create, change, and delete rulesets and rules, and apply them to engines |
No permission is reserved for the Owner. What prevents escalation is that you can only hand out what you hold: creating or editing a role, assigning a role to a member, or pinning a role to an invitation is refused if the role carries a permission your own role lacks.
Roles#
Two kinds of roles exist:
- Owner — the one platform default, marked Platform default on Settings → Roles. It holds every permission and can't be changed or deleted. The person who creates the organization becomes its first Owner; an organization can have several Owners and always keeps at least one.
- Custom roles — any role you create with New role on Settings → Roles: a name, an optional description, and any set of permissions from the three groups. Creating, editing, and deleting roles needs RBAC and Manage team.
Some older organizations also have a Full Access role. It is an ordinary custom role — edit or delete it like any other.
Roles are bundles
A member holds exactly one role at the organization level. To give partial access, create a role with that exact permission subset and assign it. The only grants outside a role are per-engine and per-content access, described below.
Deleting a role leaves everyone who held it in the organization with no role, and pending invitations pinned to it arrive with no role. A role that an organization API key still carries can't be deleted — give the key a different role or revoke it first.
Assigning a role#
Open Settings → Team, and on the Members tab pick a role for the member. Choosing No role leaves them a member with no permissions — they can still sign in, but no role gives them engines, settings, or billing. To give someone a role before they join, set Role on arrival when you invite them from the Invitations tab. Assigning roles needs RBAC and Manage team; sending invitations needs Manage team.
Only an Owner can give the Owner role to someone or take it away, and the last remaining Owner can't be demoted or removed. An invitation can't carry the Owner role.
Engine access#
A role's engine permissions — View engines, Run translations, Edit engines, Delete engines — apply to every localization engine in the organization. Create engines is organization-wide only.
To narrow access, grant specific users specific engines. A per-engine grant gives that member view, translate, edit, and delete on that one engine. Grants are additive — a role that already carries an engine permission covers every engine regardless. To restrict a user to a single engine, give them a role without the engine permissions, then grant them that engine.
The dashboard has no control for per-engine grants; set them through the API or the MCP server:
| Call | MCP tool | Needs |
|---|---|---|
PUT /organizations/:id/users/:userId/engine-access | permissions_setUserEngineAccess | Manage team. Replaces the member's engine list |
POST /engines/:id/members | permissions_addEngineMember | Edit engines on that engine |
DELETE /engines/:id/members/:userId | permissions_removeEngineMember | Edit engines on that engine |
Grants only work while the person is a member of the organization, and only when RBAC is on.
Content access#
Glossaries, brand voices, and rulesets work the same way. A per-item grant gives a member view and edit on that one glossary, brand voice, or ruleset, on top of their role. Separately, anyone who can view an engine can read the content applied to it, so they can understand its output.
Set per-item grants with PUT /organizations/:id/users/:userId/content-access (MCP: permissions_setUserContentAccess), which needs Manage team and replaces the member's whole content list.
Organization API keys#
Settings → API keys has separate tabs for personal and organization keys. Both are available on every plan. Personal keys act with their creator's access. Organization keys belong to the organization and keep working when people leave.
Without Enterprise RBAC, an organization key can read and translate with every engine in its organization. It cannot edit or delete engines, review translations, or administer the organization. Creating a key requires Manage API keys (org:manage_api_keys).
Enterprise RBAC adds roles and engine restrictions:
- A key's optional role may contain only View engines (
engine:read) and Run translations (engine:translate). Its role permissions apply across the organization. - Per-engine grants add translation access to the named engines. You can only grant engines you can translate with yourself. Roles and engine grants are additive.
- Changing a key's role, engine grants, or content scope requires RBAC and Manage API keys. Content scope can name glossaries, brand voices, and rulesets you can edit.
If RBAC is removed, ordinary organization keys use the basic organization-wide read-and-translate access described above. Stored role and engine restrictions no longer limit that access. Revoke or rotate keys before removing RBAC if those restrictions are required.
See API Keys for creating and revoking keys.
Ownership#
There is no separate transfer-ownership step. An Owner hands ownership to someone else by picking Owner for them on Settings → Team, and the organization must always keep at least one Owner. Because an invitation can't carry the Owner role, invite the person with another role first, then make them Owner once they have accepted. To step down, promote another member to Owner, then lower your own role (with RBAC on) or remove yourself.