Roles & Permissions

Status

Owner: TBD · Status: draft · Canonical source: flezi.app.api.backend/app/authz/matrix.py

Who is this for?

All users and administrators seeking clarity on role privileges.

What can you do?

Understand the 5 system user roles and what capabilities each role unlocks.

Role Comparison Matrix

Capability	System Admin	Org Admin	Workspace Admin	Workspace Member	AI Builder
Create new Organization	✅	—	—	—	—
Create new Workspace	—	✅	✅	—	—
Invite Workspace Members	—	✅	✅	—	—
Chat with Agents	✅	✅	✅	✅	✅
Create Personal Agents	✅	✅	✅	✅	✅
Publish Skills to Store	—	✅	—	—	—
Author AGT Policy YAML	—	✅	—	—	✅
View LLM Costs & Governance	✅	✅	—	—	✅
Add a new MCP Connector	✅	✅	—	—	—
Manage Google/Slack App Credentials	✅	✅	✅	—	—
Authorize an account for a shared connector	✅	✅	✅	✅	✅

MCP scope

A user may authorize their own account for a shared connector, but OAuth tokens are never shared between users. Creating a connector and managing provider App Credentials are separate permissions; contact an Org Admin or Workspace Admin if a control is disabled.

Notes & Common Errors

• If a button appears disabled or returns 403 Forbidden, your account role in the active workspace does not have sufficient permissions.
• Reach out to your Workspace Admin or Org Admin to request an elevated role.

Related

• Organizations & Workspaces
• Technical Authorization Matrix