Roles & permissions

A practical map of the workspace roles and what each can do.

There are two role systems in Cocobox: workspace roles and connection roles. This page covers workspace roles. For connection roles, see Sharing & roles.

Workspace roles

Role	Manage members	Manage billing	Manage AI keys	Create connections	Default connection role
owner	✅	✅	✅	✅	admin
admin	✅	❌	✅	✅	admin
member	❌	❌	❌ (use, not edit)	✅	none until granted
guest	❌	❌	❌	❌	none until granted

Owner can transfer ownership but cannot remove themselves until they do. There’s exactly one owner per workspace.

Admin is the practical day-to-day “operator” role. Admins can do everything except billing and ownership transfer.

Member is the typical engineer or analyst — full editor access, can manage their own snippets, can be granted connection roles by admins.

Guest is for external collaborators — auditors, contractors. Guests can only see what’s been explicitly shared with them. They can’t see the workspace’s connection list, member list, or AI settings.

Changing a role

Settings → Members → click a member → Change role.

The actor must be admin or owner. Owners can demote anyone (including themselves, if they first transfer ownership).

Invitation roles

When you invite by email, you pick the role. The invitee gets that role on accept. Invitations expire after 14 days.

Programmatic actors

API keys aren’t members — they’re a separate principal. They have a scope instead of a role. An API key’s effective access is the intersection of its scope and the role of the user who created it.

Audit

Every role change appears in the audit log. actor.role, target.user.id, details.previous_role, details.new_role — fully diffable.