> ## Documentation Index
> Fetch the complete documentation index at: https://reedai-07fa30f1.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> Understand and manage team member roles and access controls in projects

## Roles Overview

ZeroTwo uses role-based access control (RBAC) to manage what team members can do within projects. Each role has specific permissions that balance collaboration with security.

<Note>
  Roles apply at the project level. A user can have different roles in different projects.
</Note>

## Default Roles

ZeroTwo provides four built-in roles with predefined permissions.

<Tabs>
  <Tab title="Owner">
    **Full project control**

    The project creator automatically becomes the Owner.

    **Permissions**:

    * ✅ All Admin permissions
    * ✅ Transfer ownership
    * ✅ Delete project
    * ✅ Change project billing
    * ✅ Cannot be removed from project

    **Best for**: Project creator, primary stakeholder

    <Info>
      Each project has exactly one Owner. Ownership can be transferred to another Admin.
    </Info>
  </Tab>

  <Tab title="Admin">
    **Project management**

    Full administrative control except ownership actions.

    **Permissions**:

    * ✅ All Editor permissions
    * ✅ Manage project settings
    * ✅ Invite and remove members
    * ✅ Change member roles
    * ✅ Archive project
    * ✅ Manage integrations
    * ✅ Configure custom instructions
    * ✅ Create and edit assistants

    **Best for**: Project managers, team leads

    **Limitations**:

    * ❌ Cannot delete project
    * ❌ Cannot transfer ownership
    * ❌ Cannot change project billing
  </Tab>

  <Tab title="Editor">
    **Content creation**

    Full read-write access to project content.

    **Permissions**:

    * ✅ All Viewer permissions
    * ✅ Create conversations
    * ✅ Edit own conversations
    * ✅ Upload and delete files
    * ✅ Use all project tools
    * ✅ Create Canvas documents
    * ✅ Use project assistants
    * ✅ Share conversations externally (if allowed)
    * ✅ Create folders

    **Best for**: Team members, contributors, developers

    **Limitations**:

    * ❌ Cannot edit others' conversations
    * ❌ Cannot manage project settings
    * ❌ Cannot invite members
    * ❌ Cannot create/edit project assistants
  </Tab>

  <Tab title="Viewer">
    **Read-only access**

    Can view project content but not modify it.

    **Permissions**:

    * ✅ View conversations
    * ✅ View files
    * ✅ View project members
    * ✅ Search project content
    * ✅ Export/download content
    * ✅ Comment on conversations (if enabled)

    **Best for**: Stakeholders, observers, read-only access

    **Limitations**:

    * ❌ Cannot create conversations
    * ❌ Cannot upload files
    * ❌ Cannot use tools
    * ❌ Cannot edit content
    * ❌ Cannot share content
  </Tab>
</Tabs>

## Guest Role (Enterprise)

**Temporary external access**

<Info>
  Guest role is available on Team and Enterprise plans for external collaboration.
</Info>

**Guest capabilities**:

* 👀 View specific conversations (assigned by Admin)
* 💬 Comment on assigned conversations (if enabled)
* 📥 Download specific files (if allowed)
* ⏱️ Time-limited access (expires automatically)

**Guest restrictions**:

* ❌ Cannot see full project
* ❌ Cannot create new conversations
* ❌ Cannot access other project resources
* ❌ Cannot use AI models directly
* ❌ No access after expiration

**Best for**: Clients, contractors, external reviewers

## Permissions Matrix

Complete breakdown of what each role can do.

| Permission                   | Owner | Admin | Editor   | Viewer   | Guest    |
| ---------------------------- | ----- | ----- | -------- | -------- | -------- |
| **Content**                  |       |       |          |          |          |
| View conversations           | ✅     | ✅     | ✅        | ✅        | Limited  |
| Create conversations         | ✅     | ✅     | ✅        | ❌        | ❌        |
| Edit own conversations       | ✅     | ✅     | ✅        | ❌        | ❌        |
| Edit others' conversations   | ✅     | ✅     | ❌        | ❌        | ❌        |
| Delete own conversations     | ✅     | ✅     | ✅        | ❌        | ❌        |
| Delete others' conversations | ✅     | ✅     | ❌        | ❌        | ❌        |
| Comment on conversations     | ✅     | ✅     | ✅        | Optional | Optional |
| **Files**                    |       |       |          |          |          |
| View files                   | ✅     | ✅     | ✅        | ✅        | Limited  |
| Upload files                 | ✅     | ✅     | ✅        | ❌        | ❌        |
| Delete own files             | ✅     | ✅     | ✅        | ❌        | ❌        |
| Delete others' files         | ✅     | ✅     | ❌        | ❌        | ❌        |
| Download files               | ✅     | ✅     | ✅        | ✅        | Limited  |
| **Organization**             |       |       |          |          |          |
| Create folders               | ✅     | ✅     | ✅        | ❌        | ❌        |
| Rename folders               | ✅     | ✅     | ✅        | ❌        | ❌        |
| Delete folders               | ✅     | ✅     | ✅        | ❌        | ❌        |
| Move conversations           | ✅     | ✅     | ✅        | ❌        | ❌        |
| **Tools & AI**               |       |       |          |          |          |
| Use AI models                | ✅     | ✅     | ✅        | ❌        | ❌        |
| Use Canvas                   | ✅     | ✅     | ✅        | ❌        | ❌        |
| Use Web Search               | ✅     | ✅     | ✅        | ❌        | ❌        |
| Use Code Interpreter         | ✅     | ✅     | ✅        | ❌        | ❌        |
| Use integrations             | ✅     | ✅     | ✅        | ❌        | ❌        |
| **Assistants**               |       |       |          |          |          |
| Use project assistants       | ✅     | ✅     | ✅        | ❌        | ❌        |
| Create assistants            | ✅     | ✅     | ❌        | ❌        | ❌        |
| Edit assistants              | ✅     | ✅     | ❌        | ❌        | ❌        |
| Delete assistants            | ✅     | ✅     | ❌        | ❌        | ❌        |
| **Sharing**                  |       |       |          |          |          |
| Share conversations          | ✅     | ✅     | Optional | ❌        | ❌        |
| Share files                  | ✅     | ✅     | Optional | ❌        | ❌        |
| Generate share links         | ✅     | ✅     | Optional | ❌        | ❌        |
| **Team Management**          |       |       |          |          |          |
| View members                 | ✅     | ✅     | ✅        | ✅        | ❌        |
| Invite members               | ✅     | ✅     | ❌        | ❌        | ❌        |
| Remove members               | ✅     | ✅     | ❌        | ❌        | ❌        |
| Change member roles          | ✅     | ✅     | ❌        | ❌        | ❌        |
| Invite guests                | ✅     | ✅     | ❌        | ❌        | ❌        |
| **Project Settings**         |       |       |          |          |          |
| View settings                | ✅     | ✅     | Limited  | Limited  | ❌        |
| Edit project details         | ✅     | ✅     | ❌        | ❌        | ❌        |
| Configure tools              | ✅     | ✅     | ❌        | ❌        | ❌        |
| Custom instructions          | ✅     | ✅     | ❌        | ❌        | ❌        |
| Manage integrations          | ✅     | ✅     | ❌        | ❌        | ❌        |
| Privacy settings             | ✅     | ✅     | ❌        | ❌        | ❌        |
| Archive project              | ✅     | ✅     | ❌        | ❌        | ❌        |
| Delete project               | ✅     | ❌     | ❌        | ❌        | ❌        |
| Transfer ownership           | ✅     | ❌     | ❌        | ❌        | ❌        |
| **Billing**                  |       |       |          |          |          |
| View billing                 | ✅     | ❌     | ❌        | ❌        | ❌        |
| Manage billing               | ✅     | ❌     | ❌        | ❌        | ❌        |

## Assigning Roles

How to set roles for team members.

### When Inviting New Members

<Steps>
  <Step title="Open invite dialog">
    Click **Invite Members** in the project settings or members panel
  </Step>

  <Step title="Enter email addresses">
    Add one or more email addresses (comma-separated)

    ```
    colleague@company.com, developer@agency.com
    ```
  </Step>

  <Step title="Select role">
    Choose the appropriate role from the dropdown:

    * **Admin** - For project managers
    * **Editor** - For active contributors (default)
    * **Viewer** - For observers
    * **Guest** - For temporary external access
  </Step>

  <Step title="Add optional message">
    Include a personal message with the invitation

    ```
    Welcome to the Marketing Campaign project! This will be our main 
    workspace for Q1 initiatives.
    ```
  </Step>

  <Step title="Send invitation">
    Click **Send Invites** to notify team members
  </Step>
</Steps>

### Changing Existing Member Roles

<Steps>
  <Step title="Open members panel">
    Go to Project Settings > Members or click the members icon in the header
  </Step>

  <Step title="Find the member">
    Locate the team member whose role you want to change
  </Step>

  <Step title="Click role dropdown">
    Click the current role badge next to their name
  </Step>

  <Step title="Select new role">
    Choose the new role from the dropdown

    <Warning>
      Role changes take effect immediately. The member will be notified of the change.
    </Warning>
  </Step>

  <Step title="Confirm change">
    Click **Update Role** to apply

    <Check>
      The member's permissions are updated instantly.
    </Check>
  </Step>
</Steps>

## Custom Roles (Enterprise)

Create roles tailored to your organization's needs.

<Info>
  Custom roles are available on Enterprise plans only.
</Info>

### Creating Custom Roles

<Steps>
  <Step title="Open role management">
    Organization Settings > Roles & Permissions
  </Step>

  <Step title="Click Create Custom Role">
    Click **+ New Custom Role**
  </Step>

  <Step title="Name and describe">
    **Role Name**: `Content Reviewer`

    **Description**: `Can view and comment on content but not create new conversations`
  </Step>

  <Step title="Configure permissions">
    Select specific permissions:

    **Content Permissions**:

    * ✅ View conversations
    * ✅ Comment on conversations
    * ❌ Create conversations
    * ❌ Edit conversations

    **File Permissions**:

    * ✅ View files
    * ✅ Download files
    * ❌ Upload files
    * ❌ Delete files

    **Other Permissions**:

    * ✅ View members
    * ❌ Manage settings
  </Step>

  <Step title="Save and apply">
    Save the custom role - it's now available when inviting or updating members
  </Step>
</Steps>

### Example Custom Roles

<AccordionGroup>
  <Accordion title="Content Reviewer">
    **Purpose**: Review and provide feedback without creating content

    **Permissions**:

    * View all content
    * Comment and suggest edits
    * Download files
    * No creation or deletion

    **Use case**: Content approval workflow, quality assurance
  </Accordion>

  <Accordion title="Limited Editor">
    **Purpose**: Create content with restricted capabilities

    **Permissions**:

    * Create and edit own conversations
    * Upload files
    * Use basic tools only (no integrations)
    * Cannot delete

    **Use case**: Junior team members, interns, contractors
  </Accordion>

  <Accordion title="Integration Manager">
    **Purpose**: Manage connections without full admin access

    **Permissions**:

    * Configure integrations
    * Manage API keys
    * View all content
    * Cannot manage members or billing

    **Use case**: Technical leads, DevOps team members
  </Accordion>

  <Accordion title="Assistant Creator">
    **Purpose**: Design and manage AI assistants

    **Permissions**:

    * Create and edit assistants
    * Test assistant configurations
    * View usage analytics
    * Cannot manage project settings

    **Use case**: Prompt engineers, AI specialists
  </Accordion>
</AccordionGroup>

## Permission Scopes

Understanding how permissions work in different contexts.

### Project-Level Permissions

Apply to all content within the project:

* Conversations
* Files
* Folders
* Assistants
* Settings

**Example**: An Editor can create conversations anywhere in the project.

### Content-Level Permissions

Apply to specific conversations or files:

* **Own content**: Full control over your own creations
* **Others' content**: Limited by role (Editors can't edit others' work)
* **Shared content**: Permissions set by sharer

**Example**: Editor can edit their own conversations but not others'.

### Tool-Level Permissions

Control access to specific features:

* AI models
* Canvas
* Web search
* Code interpreter
* Integrations

**Configuration**: Project Settings > Tools & Features

### Organization-Level Permissions (Enterprise)

Apply across all projects in the organization:

* User management
* Billing and subscriptions
* Organization settings
* SSO configuration
* Audit logs

**Managed by**: Organization Admins

## Access Control Best Practices

<AccordionGroup>
  <Accordion title="Principle of least privilege">
    **Start restrictive, expand as needed**:

    ✅ **Do**:

    * Start with Viewer role for new members
    * Grant Editor only when needed
    * Limit Admin role to essential members
    * Regular audit of permissions

    ❌ **Don't**:

    * Give everyone Admin access
    * Leave default roles too permissive
    * Forget to review access regularly

    <Tip>
      Most team members need only Editor access for day-to-day work.
    </Tip>
  </Accordion>

  <Accordion title="Role assignment strategy">
    **Match roles to responsibilities**:

    **Owners (1 per project)**:

    * Project sponsor
    * Department head
    * Primary stakeholder

    **Admins (2-3 per project)**:

    * Project manager
    * Team lead
    * Technical lead

    **Editors (most of team)**:

    * Developers
    * Designers
    * Content creators
    * Regular contributors

    **Viewers (as needed)**:

    * Stakeholders
    * Other departments
    * Executives reviewing progress

    **Guests (temporary)**:

    * Clients
    * External consultants
    * One-off reviewers
  </Accordion>

  <Accordion title="Regular permission audits">
    **Monthly review checklist**:

    * [ ] Remove inactive members
    * [ ] Verify Guest access hasn't expired
    * [ ] Check if any Viewers should be upgraded
    * [ ] Ensure Admins are still appropriate
    * [ ] Review custom role usage (Enterprise)
    * [ ] Update access based on role changes

    **Quarterly deep review**:

    * Comprehensive access audit
    * Permission alignment with org structure
    * Update access policies
    * Document changes
  </Accordion>

  <Accordion title="Sensitive project handling">
    **For confidential projects**:

    1. **Strict member list**: Only essential team members
    2. **No Guests**: Disable guest access entirely
    3. **Limited sharing**: Disable external sharing
    4. **Admin approval**: Require Admin approval for new members
    5. **Audit logging**: Enable comprehensive logs (Enterprise)
    6. **Two-factor**: Require 2FA for all members

    **Settings**: Project Settings > Privacy & Security
  </Accordion>
</AccordionGroup>

## Permission Conflicts

Resolving permission issues and conflicts.

### Inheritance and Precedence

**Permission hierarchy** (most restrictive wins):

1. **Organization policy** (Enterprise)
2. **Project settings**
3. **Role permissions**
4. **Content-specific permissions**

**Example**:

```
Organization: Sharing disabled globally
Project: Sharing enabled
User Role: Editor (can share)

Result: User CANNOT share (org policy overrides)
```

### Common Permission Scenarios

<Tabs>
  <Tab title="Can't edit conversation">
    **Possible reasons**:

    * Conversation created by another user (and you're not Admin)
    * Project is archived
    * Your role was downgraded
    * Content is locked by Admin

    **Check**:

    * Your current role
    * Conversation owner
    * Project status
    * Ask Admin for clarification
  </Tab>

  <Tab title="Can't use a tool">
    **Possible reasons**:

    * Tool disabled for the project
    * Your plan doesn't include the tool
    * Integration not connected
    * Your role lacks tool permissions

    **Solutions**:

    * Ask Admin to enable the tool
    * Check project settings
    * Verify integration connection
    * Upgrade plan if needed
  </Tab>

  <Tab title="Can't invite members">
    **Possible reasons**:

    * You're not Admin or Owner
    * Project reached member limit
    * Organization doesn't allow invites
    * Pending invites need approval

    **Solutions**:

    * Ask Admin/Owner to invite
    * Upgrade plan for more seats
    * Contact organization admin
  </Tab>

  <Tab title="Can't see project">
    **Possible reasons**:

    * Project is private (and you're not invited)
    * You were removed from project
    * Project was archived or deleted
    * You're in wrong organization workspace

    **Solutions**:

    * Request access from project owner
    * Check archived projects
    * Verify organization context
    * Contact support if needed
  </Tab>
</Tabs>

## Security and Compliance

Permission-related security features.

### Audit Logs (Enterprise)

Track all permission changes and access:

**Logged events**:

* Role changes
* Member additions/removals
* Permission grants/revocations
* Failed access attempts
* Sensitive actions

**Access logs**: Organization Settings > Security > Audit Logs

### Two-Factor Authentication

Require 2FA for specific roles:

**Configuration**:

* **All members**: Organization-wide requirement
* **Admins only**: Admin/Owner 2FA required
* **Sensitive projects**: Project-level 2FA requirement

**Setup**: Organization Settings > Security > 2FA Policy

### Session Management

Control how long sessions remain active:

**Settings**:

* **Session timeout**: Auto-logout after inactivity
* **Maximum session duration**: Hard session limit
* **Device management**: See and revoke active sessions

## Next Steps

<CardGroup cols={2}>
  <Card title="Invite Team Members" icon="user-plus" href="/projects/invite-and-members">
    Add collaborators to your project
  </Card>

  <Card title="Share Content" icon="share" href="/projects/shared-chats-and-docs">
    Share conversations and documents
  </Card>

  <Card title="Organization Settings" icon="building" href="/projects/org-settings">
    Configure organization-wide settings
  </Card>

  <Card title="Project Security" icon="shield" href="/privacy/data-and-compliance">
    Learn about data security and compliance
  </Card>
</CardGroup>

<Check>
  Proper role management ensures secure collaboration while enabling team productivity!
</Check>