Roles and workspaces

Two separate things decide what someone can do: their role says what kind of work they may do, and workspaces and access lists say which things they may do it to.

Roles

Every account has one of eight roles. Seven form a ladder, each one able to do everything the one above it can, plus more. The Auditor stands apart: it can change nothing, yet, like the Super Admin, it reads everyone's work.

User	Build, run & schedule your own pipelines Build, run & schedule pipelines of your own Keep your own connections, private to you Sees only their own work, runs and schedules included Can't join a workspace, and no Flows or admin areas
Analyst	Collaborate in Workspaces Everything a User can do Create & join Workspaces to collaborate Sees the pipelines, runs & schedules of every workspace they join Still no Flows or admin areas
Engineer	Build & run Flows Everything an Analyst can do Build & run Flows (cross-pipeline orchestration) Their own flows, plus any shared into a workspace they join
Operator	Monitor & manage every run and schedule Everything an Engineer can do Monitor & manage ALL runs and schedules, whoever owns them Cancel any run and pause any schedule; edit or resume a Staging one Can't delete other people's schedules or change a Production one Other people's pipelines stay private: this is the operations view
Junior Admin	Manage users, never admin-level accounts Everything an Operator can do Create, edit & deactivate users Can't manage or assign Junior Admin / Admin / Super Admin accounts No Settings or Shared Connections
Admin	Settings, shared connections & any account Everything a Junior Admin can do Manage Settings, Shared Connections, notifications & backups Manage any account, including other admins Other people's private pipelines still stay private
Super Admin	Full access to everyone's pipelines & flows Everything an Admin can do Sees every pipeline and flow on the server, whoever owns it Open, edit, run & deploy any of them Running and deploying still need access to each connection used The top role; can assign any role
Auditor	Read-only across the whole app View every pipeline, flow, run & schedule Reads other people's work without being able to change it Never edits, runs, or sees secrets No admin areas and no connections of their own

The provider someone signs in through never decides their role: an account created at sign-in gets the default role set in Settings, and an administrator promotes it.

Workspaces

A pipeline or Flow belongs to the person who made it, and is private to them unless it is shared into a workspace, whose members can then see it.

A member has a View seat (see and run the workspace's pipelines and Flows) or an Edit seat (also save, delete, share and schedule them).
A workspace is Open (anyone may join), Request (joining needs the owner's approval) or Closed (invite only).
Running still needs access to every connection a pipeline uses: sharing a pipeline does not share its connections.
A connection granted to a workspace works only for that workspace's pipelines. A member cannot use it in a private pipeline of their own, or in another workspace's.

Workspace settings

The workspace's owner, or an administrator, changes its settings; every member can read them.

Its name, description and join policy.
Members may copy pipelines out. When this is off, a member's copy of a pipeline stays in the workspace, and only the owner or an administrator can move a pipeline out.
Deploy rules, which make a deploy wait for someone else's review: see Versions, Staging and Production.
Who can approve here, worked out from roles, seats and each connection's access list, so it can be checked in one place.
Handing the workspace to one of its members (the old owner stays with an Edit seat), and deleting it once it holds no pipelines or Flows.

What the server enforces

Every rule here is checked by the server. Hidden buttons in the interface are a convenience, not the protection.