Roles and permissions in the Ory Console
The Ory Console uses role-based access control enforced through Ory Keto. Roles are assigned at two levels: workspace and project.
Workspace roles
A workspace has three roles: Owner, Developer, and Viewer.
Owner
The Owner role has full administrative control over the workspace.
- View and edit workspace metadata
- Upgrade the workspace plan
- View and manage billing
- View and manage members
- Create and delete workspace API keys
- Create projects and view the projects list
Developer
The Developer role provides day-to-day access without administrative capabilities.
- View workspace metadata
- Create projects and view the projects list
- View members
- View workspace API keys
Developers cannot:
- Edit workspace metadata
- Manage billing
- Manage workspace members
- Create or delete workspace API keys
Viewer
The Viewer role is read-only. Viewers can see how the workspace is set up, but cannot change anything or create projects.
- View workspace metadata
- View the projects list
- View members
- View workspace API keys
Viewers cannot:
- Create projects
- Edit workspace metadata
- View or manage billing
- Manage workspace members
- Create or delete workspace API keys
Workspace permission matrix
| Permission | Owner | Developer | Viewer |
|---|---|---|---|
| View workspace metadata | Yes | Yes | Yes |
| Edit workspace metadata | Yes | No | No |
| Upgrade workspace plan | Yes | No | No |
| View billing | Yes | No | No |
| Manage billing | Yes | No | No |
| View members | Yes | Yes | Yes |
| Manage members | Yes | No | No |
| View workspace API keys | Yes | Yes | Yes |
| Create/delete workspace API keys | Yes | No | No |
| Create projects | Yes | Yes | No |
| View projects list | Yes | Yes | Yes |
Project roles
A project has three roles: Owner, Developer, and Viewer.
Owner
The Owner role has full control over the project, including destructive and administrative actions. Owners inherit all Developer permissions.
In addition to Developer permissions, Owners can:
- Delete the project
- Move the project between workspaces
- Upgrade the project plan
- Add and remove collaborators
- Modify project workspace settings
Developer
The Developer role provides full access to project configuration and all Ory services.
- Read and write project configuration
- View collaborators
- Manage project API keys
- Manage custom domains (CNAMEs)
- Manage event streams
- Full access to Ory Identities (read/write identities, credentials, sessions, and messages)
- Full access to Ory Permissions (read/write relationships, read permissions)
- Full access to Ory OAuth2 (read/write clients)
Developers cannot:
- Delete or move the project
- Add or remove collaborators
- Modify project workspace settings
Viewer
The Viewer role is read-only. Viewers can inspect how a project is configured, but cannot change it and cannot reach the data the project stores.
- Read the project configuration
- View collaborators
- View project API keys
- View custom domains (CNAMEs)
- View event streams
Viewers cannot:
- Change any project configuration
- Read or write identities, credentials, sessions, or messages
- Read or write relationships, or check permissions
- Read or write OAuth2 clients
Project permission matrix
| Permission | Owner | Developer | Viewer |
|---|---|---|---|
| Read project configuration | Yes | Yes | Yes |
| Export configuration (CLI, API) | Yes | Yes | No |
| Write project configuration | Yes | Yes | No |
| View collaborators | Yes | Yes | Yes |
| Add/remove collaborators | Yes | No | No |
| View project API keys | Yes | Yes | Yes |
| Create/delete project API keys | Yes | Yes | No |
| View custom domains (CNAMEs) | Yes | Yes | Yes |
| Manage custom domains (CNAMEs) | Yes | Yes | No |
| View event streams | Yes | Yes | Yes |
| Manage event streams | Yes | Yes | No |
| Ory Identities (full read/write) | Yes | Yes | No |
| Ory Permissions (full read/write) | Yes | Yes | No |
| Ory OAuth2 (full read/write) | Yes | Yes | No |
| Delete project | Yes | No | No |
| Move project | Yes | No | No |
| Upgrade project plan | Yes | No | No |
| Modify workspace settings | Yes | No | No |
Managing roles
To change a member's role, a workspace Owner can go to Workspace settings → Members in the Ory Console.
For more information on workspaces and member management, see Workspaces & Environments.