Roles & permissions

Every member of an organisation has one role. Roles are cumulative in capability — an Owner can do everything an Admin can, and so on — with the exceptions noted below.

At a glance

Role	What they do
Owner	Billing, the organisation recovery key, break-glass recovery — plus everything an Admin can do.
Admin	Policy, members, teams, clients, branding, integrations.
Technician	Creates requests and shares, reveals credentials.
Auditor	Read-only access to requests and the audit log. Cannot create or reveal anything. Free.

What each role can do

Capability	Owner	Admin	Technician	Auditor
Create requests & shares	✓	✓	✓	—
Reveal a credential (own/recipient)	✓	✓	✓	—
Manage members, teams & roles	✓	✓	—	—
Manage clients, branding & domains	✓	✓	—	—
Set organisation policy	✓	✓	—	—
Connect & configure integrations	✓	✓	—	—
View requests across the org	✓	✓	own, recipient + their clients’	✓
View & export the audit log	✓	✓	own requests & shares	✓
Manage billing & subscription, delete the organisation	✓	—	—	—
Hold & use the org recovery key	✓	—	—	—

Note

Revealing a credential is never granted by role alone — a technician can only reveal a request they are a recipient of, and every reveal still requires a passkey step-up on the device. See Revealing a credential.

Choosing roles

• Give day-to-day staff Technician. It’s all they need to send requests and reveal.
• Give leads who set policy and connect systems Admin. Admins can assign any role except Owner; only an Owner can make someone an Owner.
• Keep Owner to one or two people — they hold billing and the recovery key.
• Give compliance staff or a client’s IT manager Auditor for read-only oversight. Auditors don’t count towards your seat total.

Teams don’t grant permissions; they’re just named groups you can pick as recipients. See Members, roles & teams.