Govern
Roles
A role is a named bundle of permissions. Assigning a role to a person, API client, worker, or agent decides what that principal can do inside a project.
Credentials answer "who is calling?" Roles answer "what may they do?"
Organization and project access
Mobius has two related layers:
| Layer | What it answers |
|---|---|
| Organization membership | What standing does this person have across the organization? |
| Project roles | What can this person or machine do inside this project? |
Owners control organization ownership and deletion. Admins handle day-to-day organization and project administration without changing owner access.
Start with system roles
| Role | Use when |
|---|---|
| Owner | A person must control organization ownership and deletion. |
| Admin | A person manages members, settings, projects, and integrations. |
| Editor | A teammate builds and runs loops and configures project resources. |
| Operator | A person or service starts and operates runs without editing loops. |
| Worker | A worker claims and completes jobs. |
| Viewer | A person or service needs read-only project access. |
| Agent | An agent needs the normal read floor before narrower action grants. |
Most teams should use these roles first. System roles are assignable but cannot be edited.
Manage access in the app
Open Settings > Access. The page separates human members, project visibility, machine identities, and project roles.
From this page you can:
- Invite a teammate and choose organization standing.
- Assign or remove project roles for a person.
- Create an API client and assign its roles.
- Inspect automatically provisioned agent and worker identities.
- Restrict the project to explicit members.
- Create a project-specific custom role.
Organization owners and admins retain access automatically. Project role assignments control everyone else.
Create a custom role
Use a custom role when no system role matches the workload. Common examples include a deploy service that may start one action, a read-only compliance integration, or an authoring service that may edit loops but not start runs.
- Under Project roles, click New role.
- Choose the closest starter role when one helps.
- Remove permissions the workload does not need.
- Add only the specific extra capabilities it requires.
- Create the role, then assign it to the intended principal.
Prefer a narrow role for each workload over one broad machine role shared by several unrelated services.
Keep admin human
Workers usually need Worker, dashboards need Viewer, and deploy services need a narrow custom role. Reserve Owner and Admin for people so the audit log attributes access-control changes to the person who made them.
Next
- Manage permissions programmatically with the Access-control API.
- Create non-human identities with API clients.
- Authenticate those clients with API keys.
- Trace changes with audit logs.