Permissions and roles
Apex roles describe what a user can do inside an organization. Every mutating action in the product — from changing org brand to archiving a workspace to emitting a PLG event — is gated by one of these roles.
The five roles
| Role | Scope | Typical use |
|---|---|---|
| Owner | Organization | The buyer / primary admin. Exactly one per org, can transfer. |
| Admin | Organization | Full mutate access across the org and every workspace under it. |
| Member | Organization | Read-only across every workspace under the org. |
| Workspace admin | Workspace | Full mutate access to a single workspace. Distinct from org admin; org admins are implicit workspace admins everywhere. |
| Portfolio viewer | Federated | Read-only on explicitly-shared metrics from other orgs. No access to your org's operational data. |
| apex_staff | Internal | Gates Apex ops surfaces under /admin/*. Orthogonal to customer-org roles. |
What each role can do
Organization-scoped actions
| Surface | Owner | Admin | Member | Workspace admin | Portfolio viewer |
|---|---|---|---|---|---|
| Org general settings (name, plan, billing) | write | write | read | read | none |
| Org brand (logo, icon, colors) | write | write | read | read | none |
| Org team (invite / remove / promote) | write | write | read | read | none |
| Org payouts (primary Stripe) | write | write | read | read | none |
| Verified domains | write | write | read | read | none |
| Org API keys | write | write | read | read | none |
| Org audit log | read | read | read | read | none |
| Archive organization | write | read | read | read | none |
Workspace-scoped actions
| Surface | Owner | Org admin | Workspace admin | Member | Portfolio viewer |
|---|---|---|---|---|---|
| Workspace general (display name, vertical, growth model) | write | write | write | read | none |
| Workspace brand overrides | write | write | write | read | none |
| Workspace team — add members | write | write | write | read | none |
| Workspace team — promote to workspace admin | write | write | read | read | none |
| Attribution | write | write | write | read | none |
| Email sending | write | write | write | read | none |
| Payouts (inherit / override) | write | write | write | read | none |
| Mobile apps | write | write | write | read | none |
| Event triggers | write | write | write | read | none |
| Data sharing (portfolio consent) | write | write | write | read | none |
| Archive workspace | write | write | read | read | none |
Your own preferences
| Surface | Every authenticated role |
|---|---|
| Profile | write (your own) |
| Appearance | write (your own) |
| Notification channels and per-event prefs | write (your own) |
| MCP keys (user-scoped) | write (your own) |
Internal ops
| Surface | apex_staff | Everyone else |
|---|---|---|
/admin/* surfaces | read/write per surface | 403 |
/api/admin/* routes | permitted | 403 |
| Read-only workspace impersonation | read | 403 |
Cross-scope rules
- Org admins are implicit workspace admins on every workspace in their org. They don't need an explicit workspace-admin grant.
- Workspace admins cannot promote other workspace admins — that action needs org admin. Adding workspace members is allowed.
- Portfolio viewers never see operational data. They see whatever the source org explicitly shared, aggregated.
- Nothing deletes. Every destructive role-gated action is archive-only. See Archive, never delete.
Related
- How Apex accounts work — the four scopes these roles operate inside.
- Archive, never delete — why no role deletes.