---
title: Roles & Permissions
description: Understand workspace-level access control and role-based permissions.
---

Avra uses role-based access control (RBAC) scoped to your organization. Each user is assigned a role that determines their permissions across the dashboard and API.

## Available Roles

| Role | Description |
|------|-------------|
| **Creator** | Full administrative access including workspace management, billing, and team administration |
| **Developer** | Technical access for API integration, model invocation, and batch operations |
| **Analyst** | Read-only access to models and batch results for reporting and analysis |
| **Billing Manager** | Access to usage metrics and invoices |
| **Auditor** | Read-only access to audit logs and usage activity |
| **Member** | Basic read access to workspace resources |

## Permission Matrix

| Capability | Creator | Developer | Analyst | Billing | Auditor | Member |
|------------|:-------:|:---------:|:-------:|:-------:|:-------:|:------:|
| **Workspace** |
| Create/Update workspace | ✓ | | | | | |
| Archive workspace | ✓ | | | | | |
| **Models** |
| View models | ✓ | ✓ | ✓ | | ✓ | ✓ |
| View model versions | ✓ | ✓ | ✓ | | ✓ | ✓ |
| Manage aliases | ✓ | ✓ | | | | |
| Invoke predictions | ✓ | ✓ | | | | |
| **Batches** |
| View batches | ✓ | ✓ | ✓ | | | ✓ |
| Create batches | ✓ | ✓ | | | | |
| Cancel batches | ✓ | ✓ | | | | |
| Download results | ✓ | | | | | |
| Delete results | ✓ | | | | | |
| **Files** |
| View files | ✓ | | | | | ✓ |
| Upload files | ✓ | | | | | |
| Download files | ✓ | | | | | |
| Delete files | ✓ | | | | | |
| **API & Webhooks** |
| Manage API keys | ✓ | ✓ | | | | |
| Manage webhooks | ✓ | ✓ | | | | |
| **Billing & Usage** |
| View usage | ✓ | ✓ | | ✓ | | |
| View invoices | ✓ | | | ✓ | | |
| **Audit** |
| View usage logs | ✓ | | | | ✓ | |
| View activity logs | ✓ | | | | ✓ | |
| **Team** |
| Manage members | ✓ | | | | | |
| View members | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |

## Key Behaviors

- **Access inheritance**: Removing a user immediately revokes their dashboard sessions and API keys
- **Least privilege**: Assign the minimum role needed for each team member's responsibilities
- **Single Sign-On**: Enterprise workspaces can enforce SSO with at least one break-glass admin using email/password + MFA

## Role Assignment

To change a user's role:

1. Navigate to **Access & Security → Members**
2. Click the member's current role
3. Select the new role from the dropdown
4. Changes take effect immediately

:::note
Every workspace requires at least one Creator. The last Creator cannot be downgraded or removed.
:::