> ## Documentation Index
> Fetch the complete documentation index at: https://docs.modular.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Review the different user roles and the permissions scoped to them

Each member of your organization needs to be assigned a role that grants them
some level of permissions. This page describes what roles exist and how to
assign users the appropriate roles.

## Manage user roles

Users with the `Owner` or `Admin` role can assign roles from the
[Members](https://console.modular.com/members) page.

You can assign a role in either of the following ways:

* **When inviting a user:** Select a role before sending the invitation.
* **After a user has joined:** Click **Update** for the user's entry and choose
  a new role.

Role changes take effect immediately. Updated permissions apply to the user's
next request, including requests made as part of an existing session.

Every role change is recorded in the
[Activities](https://console.modular.com/activities) log, including the user who
made the change, the affected member, the previous role, the new role, and the
time of the update.

## Roles and permissions matrix

| Permission                                                          | Owner | Admin | Developer | User |
| ------------------------------------------------------------------- | :---: | :---: | :-------: | :--: |
| Create endpoints & deployments ‡                                    |   —   |   —   |     —     |   —  |
| Accept Terms of Service & legal agreements                          |   ✓   |   —   |     —     |   —  |
| Transfer Owner role to another user                                 |   ✓   |   —   |     —     |   —  |
| Manage billing (payment methods, credits, auto-recharge, invoices)  |   ✓   |   ✓   |     —     |   —  |
| Invite / remove members & assign roles \*                           |   ✓   |   ✓   |     —     |   —  |
| Manage all API keys, including keys owned by others                 |   ✓   |   ✓   |     —     |   —  |
| Create / manage your own API keys                                   |   ✓   |   ✓   |     ✓     |   —  |
| Read organization API keys                                          |   ✓   |   ✓   |     ✓     |   ✓  |
| Run inference on any resource                                       |   ✓   |   ✓   |     ✓     |   ✓  |
| View resources, usage dashboards, models, endpoints & deployments † |   ✓   |   ✓   |     ✓     |   ✓  |

\* Admins can manage members and roles for everyone in the org except the
Owner. Admins cannot remove or demote the Owner.

† The deployments view shows "Contact sales" for orgs with no active
deployments.

‡ Self-serve deployment creation isn't available yet.

### Owner

The Owner, also called the Org Admin, has the highest level of access. Each
organization has exactly one Owner. By default, the first person who signs up
for an organization becomes its Owner.

Only the Owner can accept the Terms of Service and other legal agreements for
the organization. The organization can't purchase credits or run production
inference until the Owner accepts these agreements.

The Owner can also manage billing and transfer ownership to another member. When
ownership is transferred, the previous Owner becomes an Admin or receives
another selected role. An Owner can't remove or change their own role without
first transferring ownership.

### Admin

Admins manage the organization's day-to-day operations. They can manage billing,
invite and remove members, assign roles, and manage all API keys, including keys
created by other members.

Admins can't remove the Owner or change the Owner's role. Assign this role to
team leads who need broad operational access.

### Developer

Developers can run inference, view organization API keys, and create, view, and
revoke their own API keys. They can't manage keys created by other members.

Developers can't access billing or manage members and roles. Assign this role to
engineers and machine learning practitioners who build on the platform.

### User

Users can view organization resources, usage data, and API keys. They can also
run inference.

Users can't create, edit, or revoke API keys, access billing, or manage members
and roles. Assign this role to people who use your inference endpoints but don't
need broader access.