usertasksDocs
Sign in

Governance and security

Roles and permissions

Every permission, which system roles hold it and which OAuth scopes grant it — generated from the permission catalog.

A role is a named set of permissions. Members can hold several roles; their permissions are the union. Five system roles exist in every workspace and cannot be deleted; create custom roles for anything in between.

bash
usertasks roles create --set name="Finance approver" --set permissions:='["tasks.view_own","tasks.complete","reports.view"]'
usertasks users add-role <user-id> <role-id>
usertasks users remove-role <user-id> <role-id>

API keys and OAuth tokens carry a permission ceiling of their own; a request is allowed only if the credential and (for user-context credentials) the user hold the permission. Every role change is audited as a security.permission.* event.

Permission reference

Generated from lib/permissions.ts, the system role definitions and the OAuth scope map.

System roleDescriptionPermissions
OwnerFull access to everything, including billing and API keys56
AdminFull administrative access56
ManagerBuilds and manages work; no org administration50
MemberWorks tasks, data, and reports11
ViewerRead-only access6

Tasks

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
tasks.createCreate new tasks and subtasks✓✓✓✓tasks:write
tasks.view_ownView tasks assigned to them✓✓✓✓✓tasks:read tasks:write
tasks.view_allView all tasks in the organisation✓✓✓tasks:read tasks:write
tasks.assignAssign tasks to other users✓✓✓✓tasks:write
tasks.completeMark tasks as completed✓✓✓✓✓tasks:write
tasks.redirectRedirect tasks to other users✓✓✓tasks:write
tasks.escalateEscalate tasks to managers✓✓✓tasks:write
tasks.deleteSoft-delete tasks✓✓✓tasks:write
tasks.manage_queueManage the task queue✓✓✓tasks:write

Workflows

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
workflows.viewView workflow definitions✓✓✓✓✓workflows:read workflows:write workflows:run config:read config:write
workflows.createCreate new workflows✓✓✓workflows:write workflows:run config:write
workflows.editEdit workflow nodes and edges✓✓✓workflows:write workflows:run config:write
workflows.activateActivate and deactivate workflows✓✓✓workflows:write workflows:run config:write
workflows.deleteDelete workflows✓✓✓workflows:write workflows:run config:write
workflows.view_runsView workflow run history and logs✓✓✓workflows:read workflows:write workflows:run config:read config:write
workflows.manage_runsMove live (waiting or paused) workflow runs to another version✓✓✓workflows:write workflows:run config:write

AI Agents

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
agents.viewView agent definitions✓✓✓agents:read agents:write config:read config:write
agents.createCreate new agents✓✓✓agents:write config:write
agents.editEdit agent configuration✓✓✓agents:write config:write
agents.testRun agent tests in playground✓✓✓agents:write config:write
agents.deleteDelete agents✓✓✓agents:write config:write

Integrations

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
integrations.viewView integrations and connectors✓✓✓integrations:read integrations:write config:read config:write
integrations.createCreate new integrations✓✓✓integrations:write config:write
integrations.editEdit integration configuration✓✓✓integrations:write config:write
integrations.testTest integration connections✓✓✓integrations:write config:write
integrations.deleteDelete integrations✓✓✓integrations:write config:write
integrations.manage_referencesCreate and edit integration references✓✓✓integrations:write config:write

Extensibility

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
extensibility.viewView custom workflow activities✓✓✓extensibility:read extensibility:write config:read config:write
extensibility.createCreate custom workflow activities✓✓✓extensibility:write config:write
extensibility.editEdit custom workflow activity metadata and code✓✓✓extensibility:write config:write
extensibility.deleteDelete custom workflow activities✓✓✓extensibility:write config:write

Data Tables

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
data.viewView custom tables and rows✓✓✓✓✓data:read data:write config:read config:write
data.createCreate new custom tables✓✓✓data:write config:write
data.edit_schemaEdit table columns✓✓✓data:write config:write
data.manage_rowsAdd, edit, and delete rows✓✓✓✓data:write config:write
data.deleteDelete custom tables✓✓✓data:write config:write

Reports

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
reports.viewView pre-built and shared reports✓✓✓✓✓reports:read reports:write config:read config:write
reports.createCreate custom reports✓✓✓✓reports:write config:write
reports.edit_ownEdit reports you created✓✓✓✓reports:write config:write
reports.shareShare reports with the team✓✓✓reports:write config:write
reports.deleteDelete reports✓✓✓reports:write config:write

Team

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
team.view_membersView team members✓✓✓✓✓team:read team:write
team.inviteInvite new members to the organisation✓✓✓team:write
team.removeRemove members from the organisation✓✓team:write
team.change_rolesChange user roles and permissions✓✓team:write

Settings

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
settings.viewView organisation settings✓✓✓settings:read settings:write config:read config:write keys:write
settings.editEdit branding, name, and configuration✓✓settings:write config:write
settings.manage_api_keysCreate and revoke API keys✓✓keys:write
settings.manage_webhooksConfigure webhook endpoints✓✓settings:write
sync.viewSee sync status, pending changes, and deployment history✓✓✓sync:read sync:write
sync.manageConnect repositories, change sync mode, and commit queued changes✓✓✓sync:write
sync.deployRun deployments that import repository configuration into this workspace✓✓✓sync:write

Observability

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
observability.viewRead and stream workflow, integration, agent and task events (audit and security events also need View settings) and see log export destinations✓✓events:read

Packages

PermissionAllowsOwnerAdminManagerMemberViewerOAuth scopes
packages.viewSee authored packages, their versions and the installed package library✓✓✓packages:read packages:write config:read config:write
packages.manageCreate and edit packages, build and sign versions and download .utpkg files✓✓✓packages:write config:write
packages.installInstall, upgrade, complete setup and uninstall packages (each asset also needs its own create / edit permission)✓✓✓packages:write config:write