> ## Documentation Index > Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg. > People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files. > Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it. # Roles and permissions > What owners, admins, members, and custom roles can do in your organization. Every person in your organization has one role. A role is a set of permissions. Enclave checks permissions, not role names, so a custom role works the same way as a default one. ## Default roles Every organization has three default roles. They're marked **System** and can't be edited or deleted. | Role | What it can do | | - | - | | **Owner** | Everything. An organization has exactly one owner. | | **Admin** | Manages the organization: members, roles, integrations, billing, workflows, and triggers. Admins have every permission, but they can't make someone the owner, or change or remove the owner. | | **Member** | Day-to-day work. Members use Research and can view findings, coverage, workflows, runs, and agents. They can't change them. | ## Permissions by area ### Research | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | Use Research: start sessions and send messages | ✓ | ✓ | ✓ | | Rename and delete sessions | ✓ | ✓ | — | Only the person who started a session can delete it. Research also hides the tools you don't have permission to use. See [What Research can do](https://docs.enclave.ai/research/capabilities.md#permissions). ### Findings | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | View findings and PR findings | ✓ | ✓ | ✓ | | Change a finding's status | ✓ | ✓ | — | | Start workflows that save findings, such as a security hunt | ✓ | ✓ | — | See [Findings and triage](https://docs.enclave.ai/risk/findings.md). ### Workflows and runs | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | View workflows, their flow, and their history | ✓ | ✓ | ✓ | | View runs | ✓ | ✓ | ✓ | | Create and edit workflows | ✓ | ✓ | — | | Archive workflows | ✓ | ✓ | — | | Start, pause, resume, and stop runs | ✓ | ✓ | — | | Add, edit, delete, and turn on or off triggers | ✓ | ✓ | — | | Turn PR review or repository learning on or off on the **Workflows** page | ✓ | ✓ | — | A triggered run acts with organization-level access and keeps working after the person who set it up leaves. That's why only owners and admins can change triggers, and why custom roles can never get this permission. Editing a workflow that has a trigger turned on also requires it. See [Workflows](https://docs.enclave.ai/workflows/overview.md), [Triggers](https://docs.enclave.ai/workflows/triggers.md), and [Runs](https://docs.enclave.ai/workflows/runs.md). ### Agents | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | View agents | ✓ | ✓ | ✓ | | Create and edit custom agents | ✓ | ✓ | — | | Change a built-in agent's model and reasoning level | ✓ | ✓ | — | | Archive custom agents | ✓ | ✓ | — | See [Agents](https://docs.enclave.ai/workflows/agents.md). ### Coverage and repositories | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | View repositories and cloud assets | ✓ | ✓ | ✓ | | Connect repositories | ✓ | ✓ | — | | Turn PR reviews on or off for a repository | ✓ | ✓ | — | | Remove repositories | ✓ | ✓ | — | | Analyze or re-analyze a repository or your environment | ✓ | ✓ | — | See [Coverage](https://docs.enclave.ai/onboarding/coverage.md) and [PR and dependency analysis](https://docs.enclave.ai/risk/pr-analysis.md). ### Organization settings | Action | Owner | Admin | Member | | - | :-: | :-: | :-: | | See the member list | ✓ | ✓ | ✓ | | Invite and remove members, and manage invitations | ✓ | ✓ | — | | Change members' roles | ✓ | ✓ | — | | Create, edit, and delete custom roles | ✓ | ✓ | — | | Connect and manage integrations and cloud accounts | ✓ | ✓ | — | | Manage billing | ✓ | ✓ | — | | View the audit log | ✓ | ✓ | — | | Manage AI provider keys | ✓ | ✓ | — | | Manage organization secrets | ✓ | ✓ | — | Everyone can manage their own personal secrets. ## Manage members Go to **Settings** → **Members**. * **Invite someone:** click **Invite member**. Enter their **First name**, **Last name**, and **Email address**, choose a **Role**, and click **Send Invite**. * **Change a role:** click the member's current role and choose another. You can also change the role a pending invitation will grant. * **Manage invitations:** click **Resend** or **Revoke** on a pending invitation. * **Remove a member:** click **Remove**. These rules apply: * You can't change your own role. * Owners can assign any role. Admins can assign any role except **Owner**. * Admins can't change the owner's role or remove the owner. ### Transfer ownership An organization has one owner. To hand over ownership, the owner changes another member's role to **Owner** and clicks **Transfer ownership** to confirm. The new owner takes over, and your role becomes **Admin**. ## Custom roles Create a custom role when the default roles don't fit, for example a reviewer who triages findings but doesn't manage the organization. Only owners and admins can see and manage roles. **1. Open Roles** Go to **Settings** → **Roles** and click **Create role**. **2. Name the role** Enter a **Name**, for example `Security reviewer`. **3. Choose permissions** Under **Permissions**, select what the role can do. **4. Save** Click **Create role**. Assign it to people from **Settings** → **Members**, like any other role. A custom role has only the permissions you select. It doesn't inherit anything from **Member**. ### Permissions you can grant | Permission | Allows | | - | - | | **Repository · Connect** | Connect repositories, and turn PR reviews on or off for a repository | | **Repository · Disconnect** | Remove repositories from analysis | | **Finding · Read** | View findings | | **Finding · Write** | Start workflows that save findings, and analyze or re-analyze repositories and your environment | | **Finding · Status Change** | Change a finding's triage status | | **Asset · Read** | View cloud assets. Research's cloud commands need it. | | **Session · Read** | Use Research | | **Session · Write** | Rename and delete Research sessions | | **Agent · Read** | View agents and workflow runs | | **Agent · Write** | Create and edit agents, and start and stop workflow runs | | **Agent · Delete** | Archive custom agents | | **Workflow · Read** | View workflows | | **Workflow · Write** | Create and edit workflows | | **Workflow · Delete** | Archive workflows | > [!WARNING] > > A custom role can't manage members, roles, billing, integrations, the audit log, AI provider keys, or organization secrets. It also can't change workflow triggers. Use the **Admin** or **Owner** role for those. ### Edit or delete a custom role On the **Roles** page, click **Edit** or **Delete** next to the role. Deleting a role moves everyone who has it to **Member**. Pending invitations for that role need to be sent again. You can't undo a delete. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.