Roles: what admins and members can do

Every SignalPilot organization has two roles, the ones Clerk gives you: admin and member. The rule is short:

• Org resources: admins write, members read. Connections, settings, integrations, keys and secrets, the published knowledge base, projects and repository links, eval configuration, budgets, billing.
• User resources: the owner writes. Conversations, notebooks, personal MCP connectors, personal secrets, your own dashboards and reports, your own API keys. Admins can also change these when moderation is needed.
• Read is broad, write is narrow. Members see every org resource they need to do work; they cannot change org configuration or spend org money on their own authority.

"Admin" here is the role inside your organization, not SignalPilot staff. An API key inherits the role of the person who minted it: a key with the admin scope acts as an admin, and members cannot mint one.

Permissions

The server sends this permission set to the web app (GET /api/me and the chat bootstrap), which hides or disables controls a member cannot use, so a member never opens an editor that fails on save. A disabled control carries the tooltip Only org admins can change this.

Member and admin

Permission	What it allows
keys.personal	Mint, list and revoke personal API keys with the read, query and execute scopes
knowledge.propose	Propose a knowledge base entry; it lands pending until an admin approves it
usage.self	See your own usage

Admin only

Permission	What it allows
connections.write	Create, edit, delete, clone, import and export database connections
connections.test_credentials	Test arbitrary credentials through the gateway before saving them
schema.curate	Curate schema: endorsements, refinement, column corrections, semantic model, PII rules
settings.write	Change organization settings, chat defaults and MCP agent defaults
secrets.org.write	Store, rotate or clear the organization Anthropic key
byok.manage	Manage bring-your-own encryption keys
keys.admin	Mint keys with the write, admin, dbt_proxy or agent:run scopes; list and revoke every key
knowledge.publish	Publish, edit, approve and archive knowledge base entries
reports.manage	Create, edit and delete durable reports
evals.run	Change eval configuration, start or cancel runs, upload eval sets
improvements.run	Trigger, enable or disable improvement runs
schema_watches.write	Create and change schema watches
projects.write	Create, change and delete workspace and dbt projects
github.write	Install or remove the GitHub App, link repositories, import and sync
chat.default_project	Set the organization default project for chat
budgets.write	Create and close session budgets
audit.read	Read the audit log, its statistics and export it
billing.manage	Change the plan, start checkout, cancel, open the billing portal
usage.org	See organization-wide usage and credit consumption
team.manage	Invite and remove members, change roles, manage verified domains
integrations.write	Install or remove Notion and Slack integrations
mcp.org_connectors	Manage organization-scope MCP connectors and the MCP policy
security.read	Read the security status page
branch.production_write	Write files on a project's production (default) branch

What members see

• Read-only, not hidden: connections (credentials redacted) with a Managed by your org admins note where the edit form would be; schema, lineage and dbt maps; the knowledge base with a Propose an entry action; eval results; project files with settings shown as values.
• Hidden from the sidebar: BYOK, org settings and chat defaults, security status, billing, usage, audit, team management. A direct link shows Org admins manage this.
• Fully editable: conversations, notebooks, personal MCP connectors, personal secrets, their dashboards and reports, their personal API keys.

Production branches

Writes through the workspace files API to a project's default branch (its production branch) require an admin. Members work on other branches.