Roles

Control what Organization members can do with four built-in roles plus custom roles. Learn which actions each role can perform.

Every member of an organization is assigned a role. Four built-in roles ship with every organization: admin, billing, dev, and basic. Admins can also define up to 25 custom roles per organization composed from individual capabilities. There is no owner role; admin is the highest built-in level.

Role overview

Role	Manage members & groups	Manage billing & cost centers	Create & manage resources	Use existing resources
Admin	✓	✓	✓	✓
Billing	—	✓	—	List only
Dev	—	—	✓	✓
Basic	—	—	—	✓

Role descriptions

Admin: Full organization management. Admins can invite and remove members, manage groups and roles, manage billing and payment methods, and create, update, or delete any org compute resource.

Billing: View invoices and Billing Explorer, manage payment methods and billing settings, manage cost centers, and read-only listing of all org compute resources. Cannot create or modify computing resources, and cannot manage members or groups.

Dev: Can create and manage computing resources: Pods, Serverless endpoints, network volumes, Instant Clusters, and templates. Cannot manage members, groups, billing configuration, or cost centers.

Basic: Can access and use existing organization resources visible to them based on the sharing mode. Cannot create new resources.

Resource visibility

Which resources a member can see depends on their role and the organization’s sharing mode.

• Admin: Can see and manage all organization resources regardless of sharing mode.
• Dev: Can create, update, and delete resources they own or that belong to members who share at least one group with them (in closed sharing mode).
• Basic: Can use organization resources visible to them based on the sharing mode.

See Groups for how open and closed sharing modes determine which resources members can see.

Custom roles

Members with the member-management capability can define up to 25 custom roles per organization. The admin role includes this capability by default. Custom roles are composed from individual capabilities, letting you grant exactly the permissions your team needs.

Keep these limits in mind when creating custom roles:

• Role names can be up to 191 characters. Built-in role names (admin, billing, dev, basic) are reserved and cannot be used.
• You can only grant capabilities you already hold. You cannot create a custom role with more permissions than your own role.

To create a custom role:

1. Go to Settings → Roles in the console.
2. Click Create Role.
3. Enter a name and select the capabilities to include.
4. Click Save.

Assigning roles

Members with the member-management capability can assign or change member roles. The admin role includes this capability by default. To update a member’s role:

1. Go to Settings → Members in the console.
2. Find the member and click the role dropdown next to their name.
3. Select the new role and confirm.

Role changes take effect immediately.