Team Roles & Permissions
Manage team roles and permissions in Keymint, including system roles, custom roles, workspace access, and permission-based dashboard and API enforcement.
Overview
Every team member has a role, and every role carries a list of permissions. Permissions are resource:action strings — for example, license:read lets someone view licenses while license:write lets them create and edit them. A role holding * can do everything (owners).
System Roles
New teams start with four system roles:
| Role | Intended for |
|---|---|
| Owner | Full control, including billing and team deletion. There must always be at least one owner. |
| Admin | Day-to-day administration: members, products, licenses, settings. |
| Developer | API keys, integrations, and technical configuration. |
| Member | Read-mostly access for support and observers. |
You can also create custom roles with any permission combination for contractors, support tiers, or finance.
Permissions
| Resource | Actions | Gates |
|---|---|---|
license | read, write, update, delete, sign | Licenses pages and key operations; offline signing needs sign |
analytics | read | Analytics and Radar pages |
customer | read, write, delete | Customer records and portal customer management |
product | read, write, delete | Products and versions |
api_key | read, write, delete | API keys and alert integrations |
member | read, invite, write, delete | Team membership |
role | read, write, delete | Role definitions |
billing | read, write | Subscription and plan management |
settings | write | Team settings, including the customer-portal toggle |
activity | read | Audit / activity feed |
Wildcards work per resource: license:* grants every license action.
Managing Roles
Go to Team Settings → Members. From there you can invite members, assign roles, and (with role:write) create or edit custom roles. Changes apply immediately — an affected member's next navigation reflects the new permissions.
Denied Access
Pages opened without the required read permission render an access notice instead of data — for example, Analytics without analytics:read. This is a display gate only; the APIs enforce the same permissions independently, so direct API calls without the right key scope fail regardless.