> For the complete documentation index, see [llms.txt](https://docs.hava.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hava.io/collaboration/rbac.md).

# Roles & Permissions

Hava uses role-based access control (RBAC) to manage what each user can do. Roles operate at two scopes:

* **Account roles** — govern account-level administration such as managing users, teams, workspaces, billing, and audit logs.
* **Workspace roles** — govern access to workspace content such as sources, environments, projects, reports, and alerts.

Every user has exactly one account role and can have a different workspace role in each workspace they are assigned to.

{% hint style="info" %}
RBAC is available on Teams and Enterprise plans.
{% endhint %}

## Account Roles

When a user is [invited to your account](/collaboration/inviting-users.md), they are assigned the **Member** role by default. You can change this role at any time from the Members page in Account Settings.

### Role overview

| Role                | Description                                                                                                                                                                                               |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner**           | Full control over the account, including all billing, user management, teams, workspaces, and settings.                                                                                                   |
| **Account Admin**   | Manages users, teams, and workspaces. Can invite and remove users, create and manage teams, and create workspaces. No billing access.                                                                     |
| **Member**          | Base account role. Can read account information. Workspace access is controlled separately by workspace role.                                                                                             |
| **Billing Manager** | Full access to billing and subscription management. No access to workspace content.                                                                                                                       |
| **Auditor**         | Read-only access to the account audit log, member list, SSO configuration, and job logs. For auditing workspace content, assign a [WorkspaceViewer](/collaboration/workspaces.md) workspace role as well. |

### What each role can do

| Capability               | Owner | Account Admin | Member | Billing Manager | Auditor |
| ------------------------ | :---: | :-----------: | :----: | :-------------: | :-----: |
| Invite & remove users    |   ✓   |       ✓       |        |                 |         |
| Manage teams             |   ✓   |       ✓       |        |                 |         |
| Create workspaces        |   ✓   |       ✓       |        |                 |         |
| View SSO configuration   |   ✓   |       ✓       |        |                 |    ✓    |
| Update SSO configuration |   ✓   |               |        |                 |         |
| View audit log           |   ✓   |       ✓       |        |                 |    ✓    |
| Export audit log         |   ✓   |               |        |                 |    ✓    |
| Billing & subscriptions  |   ✓   |               |        |        ✓        |         |
| Delete account           |   ✓   |               |        |                 |         |

### Assigning account roles

1. Click the user dropdown in the top right and go to **Account Settings**.
2. Click **Members**.
3. Find the user you want to update and click their current role to open the role selector.

<figure><img src="/files/SetBaVI0EY6VFmNtGTqr" alt="Role selector dropdown showing available account roles"><figcaption><p>Account role selector</p></figcaption></figure>

4. Select the new role and confirm.

{% hint style="info" %}
Only Owners and Account Admins can change account roles.
{% endhint %}

## Workspace Roles

Workspace roles control what a user can do inside a specific workspace. A user (or a [team](/collaboration/teams.md) of users) can be assigned a different workspace role in each workspace they belong to.

See [Workspaces](/collaboration/workspaces.md) for how to create workspaces and assign users and teams to them.

### Role overview

| Role           | Description                                                                                                                                                                          |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Admin**      | Full control within the workspace. Can manage workspace settings, members, sources, projects, environments, reports, alerts, and tags. Can delete the workspace.                     |
| **Power User** | Can create and manage sources, environments, and views. Cannot delete the workspace, manage workspace members, delete sources, roll back environment revisions, or manage alerts.    |
| **Editor**     | Can update existing environments and views. Read-only access to sources, reports, and alerts. Can add notes and annotations. Cannot create or delete environments or manage sources. |
| **Viewer**     | Read-only access to all workspace content. Can export environments and views.                                                                                                        |
| **Guest**      | Minimal access. Can only view shared environments.                                                                                                                                   |

### What each role can do

| Capability                      | Workspace Admin |     Power User     |   Editor  |   Viewer  |    Guest    |
| ------------------------------- | :-------------: | :----------------: | :-------: | :-------: | :---------: |
| Delete workspace                |        ✓        |                    |           |           |             |
| Manage workspace members        |        ✓        |                    |           |           |             |
| Create & delete sources         |        ✓        | Create/update only |           |           |             |
| Sync sources                    |        ✓        |          ✓         |           |           |             |
| Manage projects                 |        ✓        |      Read only     | Read only | Read only |             |
| Create & delete environments    |        ✓        |          ✓         |           |           |             |
| Update environments             |        ✓        |          ✓         |     ✓     |           |             |
| View environments               |        ✓        |          ✓         |     ✓     |     ✓     | Shared only |
| Export environments             |        ✓        |          ✓         |     ✓     |     ✓     |             |
| Roll back environment revisions |        ✓        |                    |           |           |             |
| Add notes & annotations         |        ✓        |          ✓         |     ✓     |           |             |
| Manage reports                  |        ✓        |     Read/export    | Read only | Read only |             |
| Manage alerts                   |        ✓        |      Read only     | Read only | Read only |             |
| View cost usage                 |        ✓        |          ✓         |     ✓     |     ✓     |             |
| Manage tags & filters           |        ✓        |    Create/update   | Read only | Read only |             |