Avra uses role-based access control (RBAC) scoped to your organization. Each user is assigned a role that determines their permissions across the dashboard and API.
Available Roles
| Role | Description |
|---|
| Creator | Full administrative access including workspace management, billing, and team administration |
| Developer | Technical access for API integration, model invocation, and batch operations |
| Analyst | Read-only access to models and batch results for reporting and analysis |
| Billing Manager | Access to usage metrics and invoices |
| Auditor | Read-only access to audit logs and usage activity |
| Member | Basic read access to workspace resources |
Permission Matrix
| Capability | Creator | Developer | Analyst | Billing | Auditor | Member |
|---|
| Workspace | | | | | | |
| Create/Update workspace | ✓ | | | | | |
| Archive workspace | ✓ | | | | | |
| Models | | | | | | |
| View models | ✓ | ✓ | ✓ | | ✓ | ✓ |
| View model versions | ✓ | ✓ | ✓ | | ✓ | ✓ |
| Manage aliases | ✓ | ✓ | | | | |
| Invoke predictions | ✓ | ✓ | | | | |
| Batches | | | | | | |
| View batches | ✓ | ✓ | ✓ | | | ✓ |
| Create batches | ✓ | ✓ | | | | |
| Cancel batches | ✓ | ✓ | | | | |
| Download results | ✓ | | | | | |
| Delete results | ✓ | | | | | |
| Files | | | | | | |
| View files | ✓ | | | | | ✓ |
| Upload files | ✓ | | | | | |
| Download files | ✓ | | | | | |
| Delete files | ✓ | | | | | |
| API & Webhooks | | | | | | |
| Manage API keys | ✓ | ✓ | | | | |
| Manage webhooks | ✓ | ✓ | | | | |
| Billing & Usage | | | | | | |
| View usage | ✓ | ✓ | | ✓ | | |
| View invoices | ✓ | | | ✓ | | |
| Audit | | | | | | |
| View usage logs | ✓ | | | | ✓ | |
| View activity logs | ✓ | | | | ✓ | |
| Team | | | | | | |
| Manage members | ✓ | | | | | |
| View members | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Key Behaviors
- Access inheritance: Removing a user immediately revokes their dashboard sessions and API keys
- Least privilege: Assign the minimum role needed for each team member’s responsibilities
- Single Sign-On: Enterprise workspaces can enforce SSO with at least one break-glass admin using email/password + MFA
Role Assignment
To change a user’s role:
- Navigate to Access & Security → Members
- Click the member’s current role
- Select the new role from the dropdown
- Changes take effect immediately
Every workspace requires at least one Creator. The last Creator cannot be downgraded or removed.
