Complete roles & permissions matrix

Documentation Navigation:

Workspaces Access Rights - Role overview and concepts
Complete Permissions Matrix (Current) - Detailed permission specifications
Permission Reference Guide - Technical implementation details
Role Selection Guide - Practical scenarios and best practices

This page provides comprehensive permission matrices for all predefined roles in FlowX 5.0. Use this as a reference when planning access control strategies.

How to use this reference

Identify the role level

Determine whether you need organization, workspace, or project-level access

Find the appropriate role

Review the role descriptions and select the one matching your requirements

Verify permissions

Check the detailed permission matrix to ensure it meets your needs

Implement access control

Assign roles according to the principle of least privilege

Permission legend

The permission matrices use the following symbols:

Symbol	Meaning
✅	Permission is assigned
❌	Permission is not assigned
⬜	Permission is not available for this context

Organization level permissions

Organization admin permission matrix

The org_admin role has the following permissions:

Organization Administration
System Management
Monitoring & Audit

Resource	Read	Edit	Create	Delete	Admin	Comments
Organization	⬜	✅	⬜	⬜	⬜	Organization settings management
Workspaces	✅	✅	✅	✅	✅	Complete workspace lifecycle control
Users	✅	✅	✅	✅	⬜	Organization user management
Groups	✅	✅	✅	✅	⬜	User group management

Organization Admin Role Constraints

Management Rules:

Cannot be edited, duplicated, or deleted
Can only be assigned in the Organization admin space
Hidden from workspace role lists
Cannot be assigned at workspace level
Must be assigned to at least one user during initial setup

Workspace level permissions

| ✅ | ⬜ | ⬜ | ⬜ | Can see and filter all tasks available on accessible projects/libraries |

Workspace admin permission matrix

The workspace_admin role has the following permissions:

Workspace Entities
Runtime Entities
Access Management

Resource	Read	Edit	Create	Admin	Delete	Comments
Projects & libraries	⬜	⬜	✅	✅	⬜	Create projects/libraries and admin privs
Fonts	✅	✅	✅	⬜	✅	Complete font resource management
Global media library	✅	✅	✅	⬜	✅	Full media asset management
Themes	✅	✅	✅	⬜	✅	Complete theme creation and customization
Workspace audit logs	✅	⬜	⬜	⬜	⬜	Read-only access to workspace audit

Workspace Admin Role Constraints

Management Rules:

Cannot be edited or deleted (predefined role)
Listed in workspace role management interfaces
Can be assigned to users/groups within the workspace
Can be assigned when granting access to workspace
Cannot manage organization-wide settings

Workspace user permission matrix

The workspace_user role has the following permissions:

Workspace Entities
Runtime Entities
Access Management

Resource	Read	Edit	Create	Admin	Delete	Comments
Projects & libraries	⬜	⬜	✅	⬜	⬜	Can create projects and only sees projects/libraries they are given explicit access to
Fonts	✅	⬜	⬜	⬜	⬜	Can see all Fonts available for the workspace but is not allowed to edit or add new ones
Global media library	✅	⬜	⬜	⬜	⬜	Is able to view all global media files, but is not allowed to edit or add new files
Themes	✅	⬜	⬜	⬜	⬜	Can see all Themes available for the workspace but is not allowed to edit or add new ones
Workspace audit logs	✅	⬜	⬜	⬜	⬜	Can see and filter all audit logs for that workspace

Workspace User Role Constraints

Management Rules:

Cannot be edited or deleted (predefined role)
Can be duplicated to create custom variations (future feature)
Default role for most workspace members
Can be assigned when granting access to workspace
Limited administrative capabilities

Theme editor permission matrix

The theme_editor role extends workspace_user with additional permissions:

Additional Permissions
Inherited from workspace_user

Resource	Read	Edit	Create	Delete	Comments
Fonts	✅	✅	✅	✅	Full font management capabilities
Global media library	✅	✅	✅	✅	Complete media asset management
Themes	✅	✅	✅	✅	Full theme creation and customization

Theme Editor Role Constraints

Management Rules:

Same base constraints as workspace_user
Cannot be edited or deleted (predefined role)
Can be duplicated to create custom variations (future feature)
Specialized role for UI/UX designers and brand managers

Workspace runtime editor permission matrix

The workspace_runtime_editor role extends workspace_user with additional permissions:

Additional Runtime Permissions
Inherited from workspace_user

Resource	Read	Edit	Create	Delete	Comments
Workspace builds	✅	⬜	✅	⬜	Can create builds and view build information
Workspace active policy	✅	✅	⬜	⬜	Can edit active policies and runtime configurations
Scheduled processes	✅	✅	⬜	✅	Full management of scheduled processes
Configuration parameters overrides	✅	✅	✅	✅	Complete control over configuration parameter overrides
Process instances	✅	✅	⬜	⬜	Can view and edit process instances

Runtime Editor Role Constraints

Management Rules:

Same base constraints as workspace_user
Cannot be edited or deleted (predefined role)
Can be duplicated to create custom variations (future feature)
Specialized role for DevOps and runtime environment administrators

Project level permissions

Project owner permission matrix

The project_owner role has the following permissions:

Project Administration
Configuration Resources

Resource	Read	Edit	Create	Delete	Admin/Owner	Comments
Projects & Libraries	✅	✅	⬜	✅	✅	Complete project ownership and governance control

Project Owner Role Constraints

Management Rules:

System-managed role, cannot be edited or deleted
Automatically assigned to user who creates project
Hidden from role selection interfaces
Cannot be manually assigned through UI
Permanent assignment for project lifecycle
Can be transferred to another user (ownership transfer)

Project editor permission matrix

The project_editor role has the following permissions:

Project Management
Configuration Resources

Resource	Read	Edit	Create	Delete	Comments
Projects & Libraries	✅	✅	⬜	✅	Full project management except creation (handled at workspace level)

Project Editor Role Constraints

Management Rules:

Cannot be edited or deleted (predefined role)
Can be duplicated to create custom variations (future feature)
Can be assigned to users/groups when granting project access
Standard role for project team members
No ownership rights (cannot grant/revoke project access)

Project viewer permission matrix

The project_viewer role has the following permissions:

Project Access
Configuration Resources

Resource	Read	Edit	Create	Delete	Comments
Projects & Libraries	✅	⬜	⬜	❌	Read-only access to project and library information

Project Viewer Role Constraints

Management Rules:

Cannot be edited or deleted (predefined role)
Can be duplicated to create custom variations (future feature)
Can be assigned to users/groups when granting project access
Safe role for stakeholders needing visibility
No modification capabilities
Can test processes and workflows through the interface

Role comparison matrix

Quick reference: All roles compared

Permission Category	org_admin	workspace_admin	workspace_user	theme_editor	runtime_editor	project_owner	project_editor	project_viewer
Workspace Management
Create workspace	✅	❌	❌	❌	❌	❌	❌	❌
Manage workspace users	✅	✅	❌	❌	❌	❌	❌	❌
Create projects	✅	✅	✅	✅	✅	N/A	N/A	N/A
Theme & Media
Edit themes	✅	✅	❌	✅	❌	N/A	N/A	N/A
Manage fonts	✅	✅	❌	✅	❌	N/A	N/A	N/A
Edit media library	✅	✅	❌	✅	❌	N/A	N/A	N/A
Runtime Management
Create builds	✅	✅	❌	❌	✅	✅	✅	❌
Edit active policy	✅	✅	❌	❌	✅	✅	✅	❌
Manage config parameters	✅	✅	❌	❌	✅	✅	✅	❌
Project Configuration
Edit processes	✅	✅*	✅*	✅*	✅*	✅	✅	❌
Manage templates	✅	✅*	✅*	✅*	✅*	✅	✅	❌
Configure integrations	✅	✅*	✅*	✅*	✅*	✅	✅	❌
Access Control
Grant project access	✅	✅	❌	❌	❌	✅	❌	❌
Manage workspace access	✅	✅	❌	❌	❌	❌	❌	❌

* Workspace-level roles can only edit project resources for projects they have been explicitly granted access to. Having a workspace role does not automatically grant access to all projects.

Detailed capability breakdown

Organization-level capabilities

Capability	org_admin	Notes
Workspace Operations
Create new workspaces	✅	No limit on number of workspaces
Edit workspace settings	✅	Can modify any workspace configuration
Delete workspaces	✅	Permanent deletion with confirmation
View all workspaces	✅	Unrestricted visibility
User Management
Add organization users	✅	Can invite users to organization
Remove organization users	✅	Can revoke organization access
Assign organization roles	✅	Can grant org_admin to other users
View all user access	✅	Cross-workspace user visibility
System Management
Configure organization settings	✅	Organization-wide policies
Manage global font resources	✅	Fonts available to all workspaces
Configure out of office policies	✅	Organization-level OOO rules
Monitoring
View all audit logs	✅	Organization and workspace level
Monitor platform status	✅	System health across organization
Access environment information	✅	Configuration and deployment details

Workspace-level capabilities

Capability	workspace_admin	workspace_user	theme_editor	runtime_editor	Notes
Project Management
Create projects/libraries	✅	✅	✅	✅	All workspace users can create
View all workspace projects	✅	❌	❌	❌	Only admin sees all projects
Admin access to all projects	✅	❌	❌	❌	Admin has implicit access
User & Access Management
Add workspace users	✅	❌	❌	❌	Admin only
Remove workspace users	✅	❌	❌	❌	Admin only
Create/manage groups	✅	❌	❌	❌	Admin only
Assign workspace roles	✅	❌	❌	❌	Admin only
Design & Branding
Create themes	✅	❌	✅	❌	Admin and theme editor
Edit themes	✅	❌	✅	❌	Admin and theme editor
Delete themes	✅	❌	✅	❌	Admin and theme editor
Manage fonts	✅	❌	✅	❌	Admin and theme editor
Manage media library	✅	❌	✅	❌	Admin and theme editor
Runtime Operations
Create builds	✅	❌	❌	✅	Admin and runtime editor
Edit active policies	✅	❌	❌	✅	Admin and runtime editor
Manage scheduled processes	✅	❌	❌	✅	Admin and runtime editor
Manage config param overrides	✅	❌	❌	✅	Admin and runtime editor
Edit process instances	✅	❌	❌	✅	Admin and runtime editor

Project-level capabilities

Capability	project_owner	project_editor	project_viewer	Notes
Access Control
Grant project access	✅	❌	❌	Owner only
Revoke project access	✅	❌	❌	Owner only
Transfer project ownership	✅	❌	❌	Owner can transfer
Project Administration
Delete project	✅	❌	❌	Owner only (permanent)
Edit project settings	✅	✅	❌	Owner and editor
Archive project	✅	❌	❌	Owner only
Process Design
Create processes	✅	✅	❌	Owner and editor
Edit processes	✅	✅	❌	Owner and editor
Delete processes	✅	✅	❌	Owner and editor
View processes	✅	✅	✅	All roles can view
Test processes	✅	✅	✅	All roles can test
Configuration
Manage enumerations	✅	✅	❌	Owner and editor
Configure templates	✅	✅	❌	Owner and editor
Set up integrations	✅	✅	❌	Owner and editor
Manage workflows	✅	✅	❌	Owner and editor
Configure UI components	✅	✅	❌	Owner and editor
Runtime
Create builds	✅	✅	❌	Owner and editor
Manage active policies	✅	✅	❌	Owner and editor
View runtime status	✅	✅	✅	All roles
Export & Audit
Export project	✅	✅	❌	Owner and editor
View audit logs	✅	✅	✅	All roles

Permission inheritance patterns

Workspace to project inheritance

Understanding how workspace roles interact with project roles is critical for proper access management.

Key Principles:

Workspace roles DO NOT automatically grant project access
- A user with workspace_admin still needs explicit project role to access specific projects
- Exception: workspace_admin can grant themselves access via admin privileges
Project roles are additive to workspace permissions
- User can have workspace_user + project_editor on specific project
- Permissions combine (union), not override
Most permissive permission wins
- If user has project_viewer via one group and project_editor via another, they get editor access
Multiple workspace roles can be assigned simultaneously
- Users can combine workspace roles for specialized access patterns
- Example: A user can be both theme_editor and runtime_editor in the same workspace
- Permissions from all assigned roles combine (union), enabling flexible role compositions

Examples:

Scenario 1: Workspace User Creates Project
- User role: workspace_user
- Action: Creates new project "Project X"
- Result: User automatically becomes project_owner of "Project X"

Scenario 2: Workspace Admin Needs Project Access
- User role: workspace_admin
- Action: Wants to edit "Project Y" (not owner)
- Required: Must be granted project_editor or project_owner role on "Project Y"
- Note: Admin can grant themselves this access via admin privileges

Scenario 3: Multiple Role Assignments
- User role: workspace_user
- Project roles: project_viewer on "Project A", project_editor on "Project B"
- Result: Read-only access to Project A, full edit access to Project B

Scenario 4: Mix and Match Roles (Development Environment)
- User roles: theme_editor + runtime_editor
- Context: Development/QA environments where designers and developers need combined access
- Combined capabilities:
  - Full theme management (fonts, media library, theme creation/editing) from theme_editor
  - Runtime operations (create builds, edit policies, manage scheduled processes, config parameters) from runtime_editor
  - Base workspace capabilities (create projects, view workspace resources) from workspace_user inheritance
- Use case: UI/UX developers working in dev environments who need both design and deployment capabilities

Group-based permission inheritance

Group Membership Resolution:

User’s permissions = Union of (individual permissions + all group permissions)
More permissive permission always wins
No negative permissions (cannot restrict via groups)

Example:

User: John
- Individual: project_viewer on Project X
- Group A membership: project_editor on Project X
- Group B membership: workspace_runtime_editor

Result:
- Project X access: project_editor (more permissive than viewer)
- Workspace: workspace_runtime_editor capabilities
- Combined: Full project editing + runtime management

Special permission features

Read-only view behavior

Read-Only Mode Characteristics

When a user has read-only permissions (e.g., project_viewer role), they experience:Visible but Disabled:

All configuration elements visible but not editable
Save buttons hidden or disabled
Edit controls grayed out or absent
Delete actions not available

Available Functionality:

Export operations (where applicable)
Audit log access
Usage overview and tracking
Copy operations to other projects/libraries (for reference)
Process and workflow testing through interface

UI Indicators:

“View” label instead of “Configure” in contextual menus
Read-only badges or indicators
No modification prompts or warnings

Bulk permission selection

When configuring custom roles (future feature), bulk selection streamlines permission assignment.

Bulk Selection Categories:

Category	Applies To	Selectable Operations
Workspace Entities	Projects, Themes, Fonts, Media, Audit Logs	Read, Edit, Create, Delete
Access Management	Users, Groups, Roles, Platform Status	Read, Edit, Create, Delete
Runtime Permissions	Builds, Policies, Processes, Config Params	Read, Edit, Create, Delete
Project Configuration	All project resources	Read, Edit, Create, Delete

How Bulk Selection Works:

Select permission category (e.g., “Workspace Entities”)
Choose operation level (e.g., “Read”)
All resources in category receive selected permission
Individual permissions can be adjusted afterward
Saves time when creating roles with consistent patterns

Permission dependencies

Auto-Included Permissions

Certain permissions automatically include others to ensure functionality:Workspace Level:

Any workspace permission → automatically includes workspace_read
Any workspace edit permission → should include workspace_edit

Project Level:

Any project permission → automatically includes project_read (backend)
Note: project_read not displayed in UI but sent to backend

Rationale: Read permissions provide the foundation for all other operations. Without read access, users cannot see resources to edit, create, or delete them.

Workspaces Access Rights

Overview of FlowX workspace access rights and role hierarchy

Permission Reference Guide

Technical implementation details, UI mappings, and naming conventions

Role Selection Guide

Practical guidance for choosing and assigning appropriate roles

Access Management Overview

Overview of authentication and authorization in FlowX

Configuring IAM Solution

Setting up identity and access management with Keycloak

Workspaces

Understanding workspaces and organizing projects

Microservices

Plugins

Observability

Access management

​How to use this reference

​Permission legend

​Organization level permissions

​Organization admin permission matrix

Organization Admin Role Constraints

​Workspace level permissions

​Workspace admin permission matrix

Workspace Admin Role Constraints

​Workspace user permission matrix

Workspace User Role Constraints

​Theme editor permission matrix

Theme Editor Role Constraints

​Workspace runtime editor permission matrix

Runtime Editor Role Constraints

​Project level permissions

​Project owner permission matrix

Project Owner Role Constraints

​Project editor permission matrix

Project Editor Role Constraints

​Project viewer permission matrix

Project Viewer Role Constraints

​Role comparison matrix

​Quick reference: All roles compared

​Detailed capability breakdown

​Organization-level capabilities

​Workspace-level capabilities

​Project-level capabilities

​Permission inheritance patterns

​Workspace to project inheritance

​Group-based permission inheritance

​Special permission features

​Read-only view behavior

Read-Only Mode Characteristics

​Bulk permission selection

​Permission dependencies

Auto-Included Permissions

​Related documentation

Workspaces Access Rights

Permission Reference Guide

Role Selection Guide

Access Management Overview

Configuring IAM Solution

Workspaces

How to use this reference

Permission legend

Organization level permissions

Organization admin permission matrix

Workspace level permissions

Workspace admin permission matrix

Workspace user permission matrix

Theme editor permission matrix

Workspace runtime editor permission matrix

Project level permissions

Project owner permission matrix

Project editor permission matrix

Project viewer permission matrix

Role comparison matrix

Quick reference: All roles compared

Detailed capability breakdown

Organization-level capabilities

Workspace-level capabilities

Project-level capabilities

Permission inheritance patterns

Workspace to project inheritance

Group-based permission inheritance

Special permission features

Read-only view behavior

Bulk permission selection

Permission dependencies

Related documentation