Roles and permissions

Roles apply within the selected organization. A user can have different roles in different organizations. The API enforces permissions independently of whether a button is visible in the browser.

Capability	Viewer	Analyst	Admin	Owner
View organization inventory, findings and results	Yes	Yes	Yes	Yes
Triage findings and assign work	—	Yes	Yes	Yes
Read restricted evidence	—	Yes	Yes	Yes
Run passive assessments	—	Yes	Yes	Yes
Export supported reports	—	Yes	Yes	Yes
Accept risk with an expiry	—	—	Yes	Yes
Run authorized active assessments	—	—	Yes	Yes
Manage integrations and runtime tokens	—	—	Yes	Yes
Change detection policies	—	—	Yes	Yes
Read the audit log	—	—	Yes	Yes
Change member roles and organization settings	—	—	—	Yes

Active assessments also require the relevant entitlement and explicit target authorization. Having an Admin role is not authorization to test systems outside your approved scope.

Change a member’s role

An Owner can open Settings → Members, select an existing member and choose the appropriate role. Review the operational impact before reducing the only member responsible for administration. The interface and API can reject changes that violate organization rules.

Email invitations and automatic SSO group synchronization are not currently implemented. If a colleague is missing from the membership workflow, contact the operator rather than sharing your session or a runtime token.

Understand access errors

Not permitted usually means membership exists but a required permission or feature is missing. Not found can mean the resource is absent or belongs to another organization. This avoids revealing another organization’s data through guessed IDs.