> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentruntime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Workspace and project roles, public vs private projects, and how access is assigned in the AgentRuntime Console.

AgentRuntime separates **workspace** access from **project** access. Most day-to-day builder permissions come from your **project role**; workspace roles control billing, team invites, and workspace policy.

## Workspace roles

| Role       | What you can do                                                                                                    |
| ---------- | ------------------------------------------------------------------------------------------------------------------ |
| **Member** | Belong to the workspace. On **public** projects, you get the default **Contributor** project access automatically. |
| **Admin**  | Manage team invites, billing settings, domain verification, and workspace access policy.                           |
| **Owner**  | Full workspace control, including billing ownership and promoting other admins or owners.                          |

Workspace email invites set only the workspace role. They do **not** attach a specific project. After accepting, members can access **public** projects at the default contributor level.

## Project roles

<CardGroup cols={3}>
  <Card title="Contributor" icon="wrench">
    Create and edit workflows, run and control runs, manage connections and MCP instances, and view usage. Maps to the <code>project\_contributor</code> role in the API.
  </Card>

  <Card title="Project viewer" icon="eye">
    Read workflows, runs, analytics, Autopilot chat, and work items. Cannot edit graphs, manage connections, or start runs.
  </Card>

  <Card title="Project admin" icon="shield">
    Everything contributors can do, plus manage project members and toggle public vs private visibility.
  </Card>
</CardGroup>

### Capability matrix

| Capability                      | Viewer | Contributor |      Project admin      |
| ------------------------------- | :----: | :---------: | :---------------------: |
| View workflows and runs         |    ✓   |      ✓      |            ✓            |
| Edit and publish workflows      |        |      ✓      |            ✓            |
| Start, pause, stop runs         |        |      ✓      |            ✓            |
| Manage connections and MCP      |        |      ✓      |            ✓            |
| Manage project members          |        |             |            ✓            |
| Toggle public / private project |        |             |            ✓            |
| Workspace billing and team      |        |             | (workspace admin/owner) |

<Info>
  Some API endpoints also require PAT scopes (for example, `workflow:run` or `mcp:execute`) in addition to the project role. See [API authentication](/api/authentication).
</Info>

## Public vs private projects

* **Public** — Visible to all workspace members. Default access is **Contributor** unless you assign an explicit project role.
* **Private** — Hidden from the project picker unless you are a member. **Project admins** (and workspace **owners** as a backup) add members from **Project settings** (project menu ⋮).

Workspace **owners** and **admins** can open private projects they are not members of, but by default they have **read-only** project access. Workspace admins can enable **Full access on private projects** under **Settings → Team → Workspace access policy** for IT-style workspaces that need elevated recovery access.

## Managing access

| Task                   | Where                                                                             |
| ---------------------- | --------------------------------------------------------------------------------- |
| Invite to workspace    | **Settings → Team & Members** (workspace admin/owner)                             |
| Change workspace role  | **Settings → Team & Members** → member list                                       |
| Manage project members | **Project settings → Members** (project admin) or Team when a project is selected |
| See your own roles     | **Settings → My access** (all members)                                            |

## API and PAT scopes

When calling the API with a personal access token, both the user's project role and the token's scopes must allow the operation:

| Scope           | Allows                                     |
| --------------- | ------------------------------------------ |
| `workflow:read` | List and get workflows, runs, and events   |
| `workflow:run`  | Start, pause, resume, and stop runs        |
| `mcp:execute`   | Invoke MCP tools during workflow execution |

Create PATs from **Settings → API keys**.

## Sysadmin access

Internal AgentRuntime operators use a separate sysadmin login path. Sysadmin capabilities are not available to customer workspace members.