---
title: "Roles and permissions"
description: "The role keys that gate Ocho features, and how subscription tiers work."
canonical: https://ocho.bot/docs/administration/roles-and-permissions
last_updated: 2026-07-12
---

# Roles and permissions

> The role keys that gate Ocho features, and how subscription tiers work.

Access in Ocho is governed by two layers: your company's **subscription tier** (which applications and features are available at all) and **roles** (which actions you personally can take). One exception: members of the workspace **admin group** bypass role checks entirely (see [Workspace admins](#workspace-admins) below).

## Role reference

Administrators assign roles on a user's record — the **Roles** tab on the user's page in the Users table (`/table/users`). Role definitions themselves, and role assignment where the Users table isn't available, are managed in the admin CMS by a `role_admin`.

**Role key** · **Grants**

`super_rag_dataset_admin`  —  Create and build datasets, upload and delete documents, manage knowledge graphs

`document_markdown_editor`  —  Create, edit, and publish markdown documents; save chat answers to the Library

`table_admin`  —  Create custom tables and edit their columns

`app_admin`  —  Create custom applications in App Builder (the **New app** button)

`ui_builder`  —  Use the AI page builder (the **New page** button and the page-editor wand)

`citizen_developer`  —  Open the Context Inspector developer tools (the **Inspector** button in chat and the Context Inspector page)

`integration_admin`  —  Create, test, sync, reconnect, and delete integration connections

`auth_admin`  —  Configure sign-in and SSO, user access mode, and allowed email domains

`branding_admin`  —  Set company name, logo, and primary color during onboarding (the subdomain is shown but cannot be changed after setup)

`payment_admin`  —  Complete the Billing step during onboarding

`user_admin`  —  View the Users table and reset user passwords

`cost_admin`  —  See the company-wide, per-user usage breakdown on the Usage page

`group_admin`  —  Manage sharing grants to groups (owners of a resource can always share it themselves)

`role_admin`  —  Manage role definitions and role assignment in the admin CMS

`flows_author`, `flows_admin`  —  Create workflows in Ocho Flows (the **New workflow** action requires one of these)

`flows_viewer`  —  Reserved for Ocho Flows; assignable but not yet enforced in the app

When you lack a role a full page needs, Ocho shows an "Access denied" page that names the required role — contact your administrator to request it. Individual buttons and menu items you lack a role for are usually hidden; where a control is shown disabled instead, its tooltip names the required role. Actions that reach the server may fail with a message naming the required role key (for example "Requires super_rag_dataset_admin role") or, in some cases, a generic "You are not allowed to perform this action."

## Subscription tiers

Tiers order as **free < basic < pro < max < enterprise**. Navigation items and features carry a minimum tier; anything above your company's tier simply doesn't appear.

## Workspace admins

Members of the admin group bypass role checks entirely: every role-gated page, navigation item, and button renders for them, and server actions accept their requests without the matching role. Admin-group members also get the per-message **Inspect context** action in chat, on messages where context recording captured the turn.

## Good to know

- Some role keys (such as `integration_admin` and `super_rag_dataset_admin`)

are not part of the seeded role-definition list, so they may need to be   created as role definitions before they can be assigned.

- If the Users table isn't provisioned in your workspace, there is no

in-app surface for assigning roles — a `role_admin` must assign them in   the admin CMS.

- Archiving and restoring tables has no button in Data Manager; those

operations are only available through the Data Manager AI chat. They   require the `table_admin` role. In workspaces with row-level security   enabled, a table's owner can also archive and restore their own tables;   elsewhere, ownership alone is not enough.

All docs: https://ocho.bot/docs

---

Ocho — AI knowledge orchestration · [Home](https://ocho.bot/) · [Docs](https://ocho.bot/docs) · [Blog](https://ocho.bot/blog) · [About](https://ocho.bot/about) · [Developers](https://ocho.bot/developers) · [Contact](https://ocho.bot/contact) · [llms.txt](https://ocho.bot/llms.txt)