Roles & permissions
Picking a role for a collaborator gives them every permission in that role's package. You can also build a Custom role to grant any combination of permissions à la carte.
What each role can do
Every role automatically includes view-only access to every tab — Overview, Logs, Team, Settings, Deploy, Workspaces, Domains, and Env Variables. Beyond that, here's what each role adds:
| Capability | Owner | Admin | Editor | Viewer | Data Analytics |
|---|---|---|---|---|---|
| Deploy to QA | ✓ | ✓ | ✓ | ||
| Deploy to Production | ✓ | ✓ | |||
| Revert a production deploy | ✓ | ✓ | |||
| Manage workspaces (create, pull, reset, sync) | ✓ | ✓ | ✓ | ||
| Manage environment variables | ✓ | ✓ | |||
| Clear cache | ✓ | ✓ | |||
| Magic login to any environment | ✓ | ✓ | |||
| Manage team members | ✓ | ✓ | |||
| View Analytics | ✓ | ✓ | ✓ | ||
| Use Urumi AI / Urumi Agent | ✓ | ✓ | ✓ | ✓ | ✓ |
| Edit site settings | ✓ | ||||
| Manage custom domains | ✓ | ||||
| Manage GitHub connection | ✓ |
The bottom three rows are Owner-only — they're tied to whoever owns the site and can't be granted to anyone else, not even via a Custom role.
Built-in view access
Every collaborator gets view access to the standard tabs out of the box:
- The Overview tab
- The Logs tab
- The Team page (so they can see who else is on the site)
- The Settings page
- The Deploy tab
- The Workspaces tab
- The Domains tab
- The Env Variables tab
These can't be removed from any role — without them the dashboard wouldn't have anywhere for collaborators to land. If you need to keep someone out of a specific area, you do that by not granting the write permission for that area (so the buttons stay greyed out), not by hiding the tab.
The Analytics tab is the one exception — it only appears for collaborators who have Analytics access, so it stays out of the way for everyone else.
Picking a Custom role
If none of the presets fit, pick Custom when inviting or editing a collaborator. You'll see the same capabilities as the table above (minus the Owner-only ones) with checkboxes — pick whichever combination makes sense.
A couple of rules apply:
- Owner-only permissions stay with the Owner. Site settings, Custom domains, and GitHub integration can't be granted via Custom — they're filtered out of the picker.
- Built-in view access is always included. You don't need to (and can't) un-check those — every collaborator needs them to navigate the dashboard.
Within those two limits, anyone with Manage Members can build any combination they want — they don't need to hold a permission themselves to grant it to someone else.