Roles and permissions

A role is a named bundle of permissions. A permission is one thing a person may do, written as a string such as connection:share. Each person holds exactly one role. To change someone's access, you replace their role. You never add a second one.

Where to find it: Settings → People → Roles

Before you start

Everyone can see the built-in roles. You can change only custom roles.

Built-in roles

Every organization starts with eight built-in roles. You cannot edit or delete them. Elaichi keeps their permissions up to date when the product adds new capabilities.

Six of them form a ladder. Each role can do everything the role below it can do, plus one more job:

Guest → Member → Team Admin → People Admin → Org Admin → Org Owner

Two more roles sit outside the ladder, for people who need one narrow slice of access.

Guest, Billing Admin and Auditor are free seats. They do not use a billable seat.

Permissions by built-in role

A check mark means the role holds the permission. The first table covers the six ladder roles.

The two free-seat roles that sit outside the ladder hold only what their job needs.

Permission catalog

These are the permissions you can tick when you create a custom role. The role editor groups them the same way.

Four verbs repeat across the catalog. Each one always means the same thing.

Organization

Billing

Connectors

Connections

Templates

Toolboxes

Governance

Tool execution

API tokens

SSO and identity

Logging

Notifications

Create a custom role

1. Open Settings → People → Roles.
2. Choose New role.
3. Enter a Name that says the job, such as "Support lead" or "Read-only analyst". Optionally, enter a Description.
4. Under Permissions, tick the permissions from the catalog. To begin from an existing role's permissions, choose Start from an existing role.
5. Choose Create role.
6. Assign the role to people from Settings → People → Members. Or map it to a SCIM group under Settings → SSO and SCIM.

You will know it worked when people with that role see the screens and actions you intended, and nothing more.

Edit or delete a custom role

1. Open Settings → People → Roles.
2. Open the role's row menu. Choose Edit role (or View role for a built-in role).
3. To change it, update the fields and choose Save changes. To remove it, choose Delete role.

If members or pending invites use the role you delete, Elaichi asks where they go. Under Move everyone to, choose a role for all of them, or choose a role for each member. Moving people to another role needs Manage members (member:manage). You cannot delete a role while an SSO group mapping points at it. Change the mapping to another role first. Deleting a role cannot be undone.

A role change applies right away, including to people who are signed in now.

How roles combine with other access

A role is one of three layers. A tool runs only when all three allow it.

flowchart TD
  Ask["Agent asks for a tool"] --> Role["Role permissions<br/>may they use MCP / connectors?"]
  Role --> Share["Resource share<br/>view / use / edit on toolbox"]
  Share --> Restrict["Restrictions<br/>connector or tool allow/block"]
  Restrict --> Run["Tool runs<br/>through their connections"]

In words: Elaichi first checks the person's role permissions, then the share on the toolbox or custom connector, then the restrictions. The tool runs only when all three checks pass.

What to know

• Each person holds exactly one role. Promoting someone replaces their role.
• Changes apply right away, including to people who are signed in now, and to API tokens and your organization's MCP endpoint when they run as that person.
• You cannot edit built-in roles. Copy what you need into a custom role instead.
• You cannot remove or demote the last Org Owner until someone else is an Owner.
• New people who join by invite, verified domain or SCIM with no group mapping get Member unless you choose another role.

Related

• Invite and manage people
• Organize people into teams
• Set connector and tool restrictions
• Provisioning members with SCIM