Understanding roles and permissions

Every member of a workspace has a role that determines what they can see and do. Estratos uses three roles, each with progressively more permissions. Roles are per workspace - the same person can be an Owner in one workspace and a Basic user in another.

Roles at a glance

* A Basic user's writes and deletes go through review: they become proposals that an Admin or the Owner approves before they touch the published graph.

Basic user

Basic users can read, write, delete, and export memories, but their writes and deletes are queued as proposals for review rather than published immediately. They cannot manage the hierarchy, members, or the audit log. This role is the default for new invitations and fits day-to-day contributors.

Admin

Admins can do everything a Basic user can, and their writes publish directly (no review). They also manage the hierarchy, approve Basic users' proposals, manage Basic members and invitations, and view the audit log. Approving a tagged proposal is reserved for the Owner, because tagged memories affect every client. Admins cannot manage another Admin, the Owner, or themselves. They also cannot change workspace settings, manage API keys or webhooks, delete the workspace, or transfer ownership.

Owner

The Owner has full administrative control over the workspace: every member and invitation, the audit log, workspace settings, API keys, webhooks, and workspace deletion. Every workspace has exactly one Owner, and the Owner role cannot be edited or removed from the members page.

Roles set the ceiling

A role sets the ceiling of what a member - and any OAuth token they issue - can do. OAuth scopes narrow that ceiling, and Estratos checks the token's entire scope set against the member's current role on every call. If even one granted scope is above the current role, Estratos rejects the whole token rather than partially accepting its lower scopes. For example, a token that includes members:admin is rejected after its member becomes a Basic user, even when the attempted action would otherwise require only memories:read.

Role changes take effect immediately for existing tokens. After a downgrade causes a token to exceed the new ceiling, reconnect the client and complete authorization again so Estratos issues a replacement token limited to the scopes the member can now use. After a promotion, reconnect and reauthorize if the client needs newly available scopes; existing tokens do not gain scopes automatically.

Changing a member's role

Admins and Owners can manage invitations from the Members & invites page. Admins can change or remove Basic users only; they cannot act on another Admin, the Owner, or themselves. Owners can manage Admins and Basic users, but ownership is never granted by invitation or edited through the members table. New invitations are always sent as Basic user or Admin.

Transferring ownership is a special action: only the current Owner can promote another member to Owner, and doing so makes the previous Owner an Admin. Since each workspace has exactly one Owner, this is how you hand over a workspace.

Which role should I assign?

• Basic user - for contributors whose writes should be reviewed before they go live
• Admin - for trusted team members who publish directly, approve others' work, manage Basic members, and review the audit log
• Owner - for the person responsible for the workspace and its members

Next steps

Learn about general settings to configure your workspace.