User Roles
The three Kimchi organization roles (Owner, Member, Viewer), what each role can do in the console, and the full permission matrix.
Every member of your Kimchi organization has a role that controls what they can see and do in the console. Roles are assigned and changed from the Members page under Account → Members.
The Members page has two tabs: Members and Invitations. The Members tab lists every person with access, along with their role, join date, and last sign-in. The Invitations tab lists pending invites. You can search the Members table by name or email.
Kimchi has three roles: Owner, Member, and Viewer. The permission matrix below shows every console capability and which roles can use it.
Roles
| Role | What it can do |
|---|---|
| Owner | Full access to every capability: member and Service Key management, organization settings, billing and credit top-up, teams, budgets, all model types, agents, integrations, coding tools, and batch jobs. |
| Member | Broad operational access. Can manage providers, self-hosted deployments, teams, agents, integrations, code reviewer, batch jobs, and settings, and can top up credits. Cannot invite, edit, or remove members, and cannot manage organization settings. |
| Viewer | View-only on every product feature. The only writes available are creating and deleting the member's own API keys. |
Permission matrix
Each table below covers one area of the console. A ✓ means the role can perform the action; a ✗ means it cannot.
This matrix reflects the default role definitions. If a role binding has been customized for your organization, the effective access may differ.
Overview and analytics
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Analytics | View analytics | ✓ | ✓ | ✓ |
| Overview | View overview page | ✓ | ✓ | ✓ |
Coding
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Code Reviewer | View code reviewer | ✓ | ✓ | ✓ |
| Code Reviewer | Add repository | ✓ | ✓ | ✗ |
| Code Reviewer | Edit code reviewer item | ✓ | ✓ | ✗ |
| Code Reviewer | Delete code reviewer item | ✓ | ✓ | ✗ |
| Adoption | View adoption report | ✓ | ✓ | ✓ |
| Usage | View usage report | ✓ | ✓ | ✓ |
| Productivity | View productivity report | ✓ | ✓ | ✓ |
| Ops | View findings / ops | ✓ | ✓ | ✓ |
| Ops | Create finding / runbook item | ✓ | ✓ | ✗ |
| Ops | Update finding / runbook item | ✓ | ✓ | ✗ |
| Ops | Delete finding / runbook item | ✓ | ✓ | ✗ |
| Ops | Execute remediation | ✓ | ✓ | ✗ |
Models
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Serverless Models | View serverless models | ✓ | ✓ | ✓ |
| External Providers | View providers | ✓ | ✓ | ✓ |
| External Providers | Add provider | ✓ | ✓ | ✗ |
| External Providers | Edit provider | ✓ | ✓ | ✗ |
| External Providers | Delete provider | ✓ | ✓ | ✗ |
| Self-Hosted Models | View deployments | ✓ | ✓ | ✓ |
| Self-Hosted Models | Create deployment | ✓ | ✓ | ✗ |
| Self-Hosted Models | Edit deployment | ✓ | ✓ | ✗ |
| Self-Hosted Models | Delete deployment | ✓ | ✓ | ✗ |
| Model Access | View model access | ✓ | ✓ | ✓ |
Tools
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Batch Jobs | View batch jobs | ✓ | ✓ | ✓ |
| Batch Jobs | Run / manage batch job | ✓ | ✓ | ✗ |
Remote
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Remote Sessions | View remote sessions | ✓ | ✓ | ✓ |
| Remote Credentials | View remote credentials | ✓ | ✓ | ✓ |
Agents
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Agents | View agents | ✓ | ✓ | ✓ |
| Agents | Create agent | ✓ | ✓ | ✗ |
| Agents | Run agent | ✓ | ✓ | ✗ |
| Agents | Delete agent | ✓ | ✓ | ✗ |
| Agents | Modify schedule | ✓ | ✓ | ✗ |
| Integrations | View integrations | ✓ | ✓ | ✓ |
| Integrations | Add integration | ✓ | ✓ | ✗ |
| Integrations | Edit integration | ✓ | ✓ | ✗ |
| Integrations | Disconnect integration | ✓ | ✓ | ✗ |
Governance
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Budgets | View budgets | ✓ | ✓ | ✓ |
| Budgets | Edit/delete budget | ✓ | ✓ | ✗ |
Account
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| Settings | View settings | ✓ | ✓ | ✓ |
| Settings | Edit settings | ✓ | ✓ | ✗ |
| Members | View members | ✓ | ✓ | ✓ |
| Members | Invite member | ✓ | ✗ | ✗ |
| Members | Edit member | ✓ | ✗ | ✗ |
| Members | Remove member | ✓ | ✗ | ✗ |
| Organization Settings | View organization settings | ✓ | ✓ | ✓ |
| Organization Settings | Edit organization settings | ✓ | ✗ | ✗ |
| Teams | View teams | ✓ | ✓ | ✓ |
| Teams | Create team | ✓ | ✓ | ✗ |
| Teams | Edit team | ✓ | ✓ | ✗ |
| Teams | Delete team | ✓ | ✓ | ✗ |
| Pricing & Billing | Top up credits | ✓ | ✓ | ✗ |
Settings
| Capability | Action | Owner | Member | Viewer |
|---|---|---|---|---|
| API Keys | View API keys | ✓ | ✓ | ✓ |
| API Keys | Create API key | ✓ | ✓ | ✓ |
| API Keys | Set API key budget | ✓ | ✓ | ✗ |
| API Keys | Delete API key | ✓ | ✓ | ✓ |
| Service Keys | View service keys | ✓ | ✓ | ✓ |
| Service Keys | Create service key | ✓ | ✗ | ✗ |
| Service Keys | Set service key budget | ✓ | ✓ | ✗ |
| Service Keys | Delete service key | ✓ | ✗ | ✗ |
Special cases
A few capabilities do not follow the standard role pattern:
- API keys are not role-gated. Any member can create an API key from the API Keys page, and each member can delete only the keys they created. Setting an API key's budget does require the Owner or Member role.
- Service Keys follow member management. Creating and deleting Service Keys uses the same permissions as inviting and removing members, so only Owners can do it. Setting a Service Key budget requires Owner or Member.
- Some pages are available to every role. The Overview page, Model Access, Remote Sessions, and Remote Credentials are not gated by role; every member of the organization can open them.
Edit a user's role
- Go to Account → Members, find the member in the table, click the ⋯ button in the Actions column, and choose Edit role.
- Pick the new role from the dropdown. The dialog shows the member's name and email.
- Click Save. The change applies immediately.
What you can and can't do
The row menu on the Members page enforces the following rules:
- Only Owners can use the Edit role and Remove member actions. If those actions are disabled in the row menu, your current role is not Owner; ask another Owner to make the change for you.
- You can't change your own role. The Edit role action is disabled on your own row; ask another Owner to change it for you.
- You can't remove yourself if you are the last Owner. The Remove member action is disabled on your own row when you are the only Owner in the organization; add another Owner first, or ask another Owner to remove you.
Audit
Role changes are not currently recorded in an audit log.
See also
Updated 17 days ago