Roles and permissions in the Ory Console
The Ory Console uses role-based access control enforced through Ory Keto. Roles are assigned at two levels: workspace and project.
Workspace roles
A workspace has three roles: Owner, Developer, and Viewer.
Owner
The Owner role has full administrative control over the workspace.
- View and edit workspace metadata
- Upgrade the workspace plan
- View and manage billing
- View and manage members
- Create and delete workspace API keys
- Create projects and view the projects list
Developer
The Developer role provides day-to-day access without administrative capabilities.
- View workspace metadata
- Create projects and view the projects list
- View members
- View workspace API keys
Developers cannot:
- Edit workspace metadata
- Manage billing
- Manage workspace members
- Create or delete workspace API keys
Viewer
The Viewer role is read-only. Viewers can see how the workspace is set up, but cannot change anything or create projects.
- View workspace metadata
- View the projects list
- View members
- View workspace API keys
Viewers cannot:
- Create projects
- Edit workspace metadata
- View or manage billing
- Manage workspace members
- Create or delete workspace API keys
Workspace permission matrix
| Permission | Owner | Developer | Viewer |
|---|---|---|---|
| View workspace metadata | Yes | Yes | Yes |
| Edit workspace metadata | Yes | No | No |
| Upgrade workspace plan | Yes | No | No |
| View billing | Yes | No | No |
| Manage billing | Yes | No | No |
| View members | Yes | Yes | Yes |
| Manage members | Yes | No | No |
| View workspace API keys | Yes | Yes | Yes |
| Create/delete workspace API keys | Yes | No | No |
| Create projects | Yes | Yes | No |
| View projects list | Yes | Yes | Yes |
Project roles
A project has three roles: Owner, Developer, and Viewer.
Owner
The Owner role has full control over the project, including destructive and administrative actions. Owners inherit all Developer permissions.
In addition to Developer permissions, Owners can:
- Delete the project
- Move the project between workspaces
- Upgrade the project plan
- Add and remove collaborators
- Modify project workspace settings
Developer
The Developer role provides full access to project configuration and all Ory services.
- Read and write project configuration
- View collaborators
- Manage project API keys
- Manage custom domains (CNAMEs)
- Manage event streams
- Full access to Ory Identities (read/write identities, credentials, sessions, and messages)
- Full access to Ory Permissions (read/write relationships, read permissions)
- Full access to Ory OAuth2 (read/write clients)
- Full access to Ory Talos Secure API Keys (view and manage API keys, use the Playground, and change the configuration)
Developers cannot:
- Delete or move the project
- Add or remove collaborators
- Modify project workspace settings
Viewer
The Viewer role is read-only. Viewers can inspect how a project is configured, but cannot change it and cannot reach the data the project stores.
- Read the project configuration
- Read the Ory Talos configuration
- View collaborators
- View project API keys
- View custom domains (CNAMEs)
- View event streams
Viewers cannot:
- Change any project configuration
- Read or write identities, credentials, sessions, or messages
- Read or write relationships, or check permissions
- Read or write OAuth2 clients
- View or manage Ory Talos API keys, or use the Ory Talos Playground
Project permission matrix
| Permission | Owner | Developer | Viewer |
|---|---|---|---|
| Read project configuration | Yes | Yes | Yes |
| Export configuration (CLI, API) | Yes | Yes | No |
| Write project configuration | Yes | Yes | No |
| View collaborators | Yes | Yes | Yes |
| Add/remove collaborators | Yes | No | No |
| View project API keys | Yes | Yes | Yes |
| Create/delete project API keys | Yes | Yes | No |
| View custom domains (CNAMEs) | Yes | Yes | Yes |
| Manage custom domains (CNAMEs) | Yes | Yes | No |
| View event streams | Yes | Yes | Yes |
| Manage event streams | Yes | Yes | No |
| Ory Identities (full read/write) | Yes | Yes | No |
| Ory Permissions (full read/write) | Yes | Yes | No |
| Ory OAuth2 (full read/write) | Yes | Yes | No |
| View and manage Ory Talos API keys | Yes | Yes | No |
| Use the Ory Talos Playground | Yes | Yes | No |
| Read Ory Talos configuration | Yes | Yes | Yes |
| Write Ory Talos configuration | Yes | Yes | No |
| Delete project | Yes | No | No |
| Move project | Yes | No | No |
| Upgrade project plan | Yes | No | No |
| Modify workspace settings | Yes | No | No |
Managing roles
To change a member's role, remove the member and invite them again with the new role. This applies to workspace roles and to project roles. Manage workspace members under Workspace settings → Members, and project members under Project settings → Members.
Removing a member also cancels their pending invitations to that workspace or project. Send the new invitation after you remove the member.
A member's workspace role and project role are distinct but connected. The workspace role sets the member's access to the workspace and all its projects. A project role can raise that access within one project, but it can't lower it. For example, a workspace Viewer who is a project Owner has Owner access in that project and Viewer access everywhere else. A workspace Owner who is a project Viewer keeps Owner access in that project.
Ory links the two roles by account email address. Send both invitations to the same email address. Ory grants each role to the account that uses the email address on the invite, so invitations sent to different addresses give roles to different accounts.
For more information on workspaces and member management, see Workspaces & Environments.