Every teammate in a TRACIO workspace has one of four roles. The role controls what they can see and change in the dashboard; the same rules are enforced server-side on every API call, so the UI and the API always agree.
Roles are assigned when you invite a teammate (Settings → Members → Invite Member) and can be changed later from the members table by anyone with workspace-settings write access. The Owner role belongs to the workspace creator and cannot be reassigned from the dashboard.
| Role | In one line |
|---|---|
| Owner | Everything — including billing changes, member invites and workspace deletion. |
| Admin | Full workspace management (settings, environments, keys, rules, activity log). No invites or billing changes. |
| Member | Day-to-day work: API keys, webhooks, rules and lists. Can't change workspace settings or environments. |
| Read Only | View-only access to analytics and configuration. No changes. |
R — read, W — write (create / edit / delete).
| Area | Owner | Admin | Member | Read Only |
|---|---|---|---|---|
| Analytics (visitors, sessions, …) | R | R | R | R |
| Workspace settings (General) | RW | RW | R | R |
| Environments | RW | RW | R | R |
| API keys | RW | RW | RW | R |
| Webhooks | RW | RW | RW | R |
| Webhook test delivery | ✓ | ✓ | — | — |
| Custom hostnames | RW | RW | RW | R |
| Request-filtering rules | RW | RW | RW | R |
| Rule backtesting | ✓ | ✓ | — | — |
| Lists (block / allow / custom) | RW | RW | RW | R |
| Billing | RW | R | R | R |
| Member invites | ✓ | — | — | — |
| Activity log | ✓ | ✓ | — | — |
| Delete workspace | ✓ | — | — | — |
Denied actions are hidden or disabled in the dashboard, and the matching API
endpoints return 403 Forbidden — a role can never do more via the API than
the dashboard shows.