Role-Based Access Control (RBAC)

Agenta uses role-based access control (RBAC) to manage what members can do inside an organization and its projects.

Availability

RBAC is enabled in every edition of Agenta, including the open source edition, where it is always enforced. On Agenta Cloud and Enterprise, enforcement follows the plan: legacy or non-RBAC plans grant full access to all members regardless of role.

Roles

Agenta provides six built-in roles arranged in a linear hierarchy. Each role inherits all permissions from the roles below it.

Role	What it is for
Owner	Full control of the organization, including billing, member management, and destructive operations
Admin	Manage workspace settings, members, and roles
Developer	Deploy to environments, manage API keys, and everything Editors can do
Editor	Edit prompts, testsets, evaluators, workflows, and other project resources
Annotator	Run evaluations, annotate traces, and review results
Viewer	Read-only access to all project resources

Role hierarchy

Permissions are cumulative from bottom to top:

Owner        ← full control (billing, org management, destructive ops)
  Admin      ← + workspace/member management, role assignment
    Developer  ← + deployments, API keys, environments
      Editor     ← + edit prompts, testsets, evaluators, workflows
        Annotator  ← + run evaluations, annotate traces
          Viewer     ← read-only access

Permissions

Under the hood, Agenta authorizes requests using granular permissions. These permissions cover actions and resources across the application, such as:

• Applications and variants
• Workflows, prompts, and configurations
• Evaluations, test sets, and evaluation queues
• Observability (traces/spans, annotations)
• Secrets and API keys (Developer and above)
• Deployments and environments (Developer and above)
• Workspace membership and roles (Admin and above)
• Billing (Owner only)

Key permission boundaries

Capability	Minimum role required
View project resources	Viewer
Run evaluations and annotate traces	Annotator
Edit prompts, testsets, evaluators, workflows	Editor
Create and rename projects	Admin
Delete projects	Owner
Deploy to environments	Developer
View and manage API keys	Developer
Invite members and assign roles	Admin
Take ownership of an agent whose owner left the project (manage_agent_ownership)	Admin
Manage billing	Owner

An API key acts with the role of the member who created it, and only in the project it belongs to. On a plan without RBAC, every member can create, rename and delete projects.

Private agents and chats

Roles decide what a member can do with the items they can see. They do not open private items. A private agent or chat is visible only to its owner and, for a chat, the people the owner added. The Owner and Admin roles do not change this: an organization owner or a project admin cannot see another member's private agent or chat.

• Taking ownership. Admins and Owners have the manage_agent_ownership permission. It lets them take ownership of a shared agent whose owner left the project. It does not open private agents.
• Sending in a shared chat. The Can send role in a chat works only for a member whose project role can run chats (Editor or above). A Viewer or Annotator can only read a chat that is shared with them.

See Share agents and chats.

Managing Roles

Assign a Role

When inviting a member, choose a role from Settings → Members.

Change a Role

Owners and Admins can change roles through the API. Roles change only through the API for now; the app has no control for it yet.

Best Practices

• Give most contributors Editor access, which covers day-to-day prompt and evaluation work.
• Use Developer for team members who need to deploy to environments or manage API keys.
• Use Annotator for teammates focused on running evaluations and labeling traces.
• Use Viewer for stakeholders who need visibility but should not change anything.
• Reserve Admin for people who manage team membership, and Owner for a small number of people.

FAQ

Can I set different roles per project?

Project-level roles are currently not supported. This will be available in the future.

Can I create custom roles?

Custom roles are not currently supported. This will be available in the future.

What's the difference between Owner and Admin?

• Owner: Full control of the organization, including billing and destructive operations (deleting the workspace or organization).
• Admin: Can manage members, assign roles, and configure workspace settings, but cannot manage billing or perform destructive organization-level operations.

What's the difference between Developer and Editor?

• Developer: Can deploy to environments, manage API keys, and do everything an Editor can.
• Editor: Can edit prompts, testsets, evaluators, and workflows, but cannot deploy or access API keys.