Roles & Permissions

deploydiff uses a two-tier role system: organization roles and project roles.

Organization roles

Every user who belongs to an organization holds exactly one org role.

Project roles

Org Owners and Admins have implicit full access to every project — no explicit project membership is needed. Org Members must be added to a project individually and receive one of two project-scoped roles.

An org Member who is promoted to Admin or Owner keeps their project roles, but those roles are inactive: the org role gives them full access to every project anyway. The project members list shows both, the effective role that governs what they can do and the project role marked inactive while org Admin. If they are later demoted back to org Member, those project roles apply again.

Permissions reference

The table below lists every action available in the dashboard. Columns represent the effective role of the acting user.

Org Member refers to an org Member with no project membership. Prj Member and Prj Participant are org Members who have been explicitly added to the project.

Deleting is restricted to Owners and Admins, everywhere in the table below — including for things a Prj Member can create. A Prj Member can add a page, archive it, disable a page in an environment, and trigger batches, because each of those can be undone. Deletion cannot: it is permanent, and it removes data other people may be relying on. See Deletion. The organization itself is the one exception: only an Owner can delete it.

Organization

Organization members

Projects

Environments

Pages

Capture batches

Diff batches

Domain validations

Notifications