Roles & Permissions
Understand workspace-level access control and role-based permissions.
Avra uses role-based access control (RBAC) scoped to your organization. Each user is assigned a role that determines their permissions across the dashboard and API.
Available Roles
| Role | Description |
|---|---|
| Creator | Full administrative access including workspace management, billing, and team administration |
| Developer | Technical access for API integration, model invocation, and batch operations |
| Analyst | Read-only access to models and batch results for reporting and analysis |
| Billing Manager | Access to usage metrics and invoices |
| Auditor | Read-only access to audit logs and usage activity |
| Member | Basic read access to workspace resources |
Permission Matrix
| Capability | Creator | Developer | Analyst | Billing | Auditor | Member |
|---|---|---|---|---|---|---|
| Workspace | ||||||
| Create/Update workspace | ✓ | |||||
| Archive workspace | ✓ | |||||
| Models | ||||||
| View models | ✓ | ✓ | ✓ | ✓ | ✓ | |
| View model versions | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Manage aliases | ✓ | ✓ | ||||
| Invoke predictions | ✓ | ✓ | ||||
| Batches | ||||||
| View batches | ✓ | ✓ | ✓ | ✓ | ||
| Create batches | ✓ | ✓ | ||||
| Cancel batches | ✓ | ✓ | ||||
| Download results | ✓ | |||||
| Delete results | ✓ | |||||
| Files | ||||||
| View files | ✓ | ✓ | ||||
| Upload files | ✓ | |||||
| Download files | ✓ | |||||
| Delete files | ✓ | |||||
| API & Webhooks | ||||||
| Manage API keys | ✓ | ✓ | ||||
| Manage webhooks | ✓ | ✓ | ||||
| Billing & Usage | ||||||
| View usage | ✓ | ✓ | ✓ | |||
| View invoices | ✓ | ✓ | ||||
| Audit | ||||||
| View usage logs | ✓ | ✓ | ||||
| View activity logs | ✓ | ✓ | ||||
| Team | ||||||
| Manage members | ✓ | |||||
| View members | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Key Behaviors
- Access inheritance: Removing a user immediately revokes their dashboard sessions and API keys
- Least privilege: Assign the minimum role needed for each team member’s responsibilities
- Single Sign-On: Enterprise workspaces can enforce SSO with at least one break-glass admin using email/password + MFA
Role Assignment
To change a user’s role:
- Navigate to Access & Security → Members
- Click the member’s current role
- Select the new role from the dropdown
- Changes take effect immediately