74 lines
3.2 KiB
Markdown
74 lines
3.2 KiB
Markdown
# Cloud organization role access
|
|
|
|
This guide documents the approved cloud organization hierarchy as it exists today.
|
|
|
|
## Scope
|
|
|
|
Organization roles authorize access inside one cloud workspace. They are separate from platform Den admin access: platform Den admins are allowlisted operators for Den admin routes and the den-admin MCP surface, and organization `owner` or `super-admin` roles do not grant that platform access.
|
|
|
|
Den Web controls enforce policy in the client by hiding or disabling actions, and Den API endpoints enforce policy by rejecting unauthorized requests. UI disabling is not security enforcement; route guards and handler checks are the security boundary. Settings reads and writes are checked separately, and OpenWork Models is an operational Models surface outside Settings.
|
|
|
|
## Built-in hierarchy
|
|
|
|
The built-in organization roles are ordered:
|
|
|
|
1. `owner`
|
|
2. `super-admin`
|
|
3. `admin`
|
|
4. `member`
|
|
|
|
`owner` satisfies every organization gate. `super-admin` satisfies super-admin and admin gates. `admin` satisfies admin gates. `member` satisfies member gates only.
|
|
|
|
Organizations may have multiple `super-admin` and `admin` members. Each organization has exactly one protected `owner`; the owner role cannot be assigned through invitations or member role changes, and the owner member cannot be removed.
|
|
|
|
## Ownership transfer
|
|
|
|
Only the current `owner` can transfer ownership. The target must be an active `super-admin`. After transfer, the target becomes the sole `owner` and the previous owner becomes `super-admin`.
|
|
|
|
## Den Web sidebar
|
|
|
|
For cloud organization admins (`owner`, `super-admin`, and `admin`), the Den Web sidebar order is:
|
|
|
|
- Dashboard
|
|
- Your Connections, when enabled
|
|
- Extensions
|
|
- Marketplace
|
|
- Sources
|
|
- Plugins
|
|
- Connectors
|
|
- Models
|
|
- OpenWork Models
|
|
- LLM Providers
|
|
- Members
|
|
- Analytics
|
|
- Settings
|
|
- General
|
|
- Diagnostics
|
|
- Brand appearance
|
|
- Desktop Policies
|
|
- Stripe
|
|
- API Keys
|
|
- SSO
|
|
- SCIM
|
|
|
|
Plain members have member access only: Dashboard, plus Your Connections when that capability is enabled.
|
|
|
|
## Role matrix
|
|
|
|
| Access or operation | `owner` | `super-admin` | `admin` | `member` |
|
|
| --- | --- | --- | --- | --- |
|
|
| Member-level workspace access | Yes | Yes | Yes | Yes |
|
|
| Operational mutation outside Settings | Yes | Yes | Yes | No |
|
|
| Settings visibility and reads | Yes | Yes | Yes, read-only | No in Den Web |
|
|
| Settings writes | Yes | Yes | No | No |
|
|
| Member role changes | Yes, except owner | Yes, except owner | No | No |
|
|
| Invitations | Invite assignable non-owner roles | Invite assignable non-owner roles | Invite `member` only | No |
|
|
| Removals | Remove non-owner members | Remove non-owner members | Remove non-owner members | No |
|
|
| Ownership transfer | Yes, to active `super-admin` | No | No | No |
|
|
|
|
The owner is the only undeletable member role. Admins can invite members and remove non-owner members, but cannot promote or demote members, write Settings, or invite elevated roles.
|
|
|
|
## Custom roles
|
|
|
|
Custom roles can add delegated permissions where the Den API supports them, but they do not replace the built-in hierarchy. Built-in role names are protected, the owner role remains transfer-only, and the highest built-in role in a member's role string controls owner/super-admin/admin/member gates.
|