Roles & Permissions

Control what each user can do in your Hava account using role-based access control.

Hava uses role-based access control (RBAC) to manage what each user can do. Roles operate at two scopes:

• Account roles — govern account-level administration such as managing users, teams, workspaces, billing, and audit logs.

• Workspace roles — govern access to workspace content such as sources, environments, projects, reports, and alerts.

Every user has exactly one account role and can have a different workspace role in each workspace they are assigned to.

RBAC is available on Teams and Enterprise plans.

Account Roles

When a user is invited to your account, they are assigned the Member role by default. You can change this role at any time from the Members page in Account Settings.

Role overview

Role	Description
Owner	Full control over the account, including all billing, user management, teams, workspaces, and settings.
Account Admin	Manages users, teams, and workspaces. Can invite and remove users, create and manage teams, and create workspaces. No billing access.
Member	Base account role. Can read account information. Workspace access is controlled separately by workspace role.
Billing Manager	Full access to billing and subscription management. No access to workspace content.
Auditor	Read-only access to the account audit log, member list, SSO configuration, and job logs. For auditing workspace content, assign a WorkspaceViewer workspace role as well.

What each role can do

Capability	Owner	Account Admin	Member	Billing Manager	Auditor
Invite & remove users	✓	✓
Manage teams	✓	✓
Create workspaces	✓	✓
View SSO configuration	✓	✓			✓
Update SSO configuration	✓
View audit log	✓	✓			✓
Export audit log	✓				✓
Billing & subscriptions	✓			✓
Delete account	✓

Assigning account roles

1. Click the user dropdown in the top right and go to Account Settings.

2. Click Members.

3. Find the user you want to update and click their current role to open the role selector.

Account role selector

1. Select the new role and confirm.

Only Owners and Account Admins can change account roles.

Workspace Roles

Workspace roles control what a user can do inside a specific workspace. A user (or a team of users) can be assigned a different workspace role in each workspace they belong to.

See Workspaces for how to create workspaces and assign users and teams to them.

Role overview

Role	Description
Admin	Full control within the workspace. Can manage workspace settings, members, sources, projects, environments, reports, alerts, and tags. Can delete the workspace.
Power User	Can create and manage sources, environments, and views. Cannot delete the workspace, manage workspace members, delete sources, roll back environment revisions, or manage alerts.
Editor	Can update existing environments and views. Read-only access to sources, reports, and alerts. Can add notes and annotations. Cannot create or delete environments or manage sources.
Viewer	Read-only access to all workspace content. Can export environments and views.
Guest	Minimal access. Can only view shared environments.

What each role can do

Capability	Workspace Admin	Power User	Editor	Viewer	Guest
Delete workspace	✓
Manage workspace members	✓
Create & delete sources	✓	Create/update only
Sync sources	✓	✓
Manage projects	✓	Read only	Read only	Read only
Create & delete environments	✓	✓
Update environments	✓	✓	✓
View environments	✓	✓	✓	✓	Shared only
Export environments	✓	✓	✓	✓
Roll back environment revisions	✓
Add notes & annotations	✓	✓	✓
Manage reports	✓	Read/export	Read only	Read only
Manage alerts	✓	Read only	Read only	Read only
View cost usage	✓	✓	✓	✓
Manage tags & filters	✓	Create/update	Read only	Read only