Skip to main content

Roles & permissions

This reference describes exactly what each role can do, how scopes nest, and the rules EntityFlow enforces around access. Owners and admins assign roles on the Members page of EntityFlow Hub.

Roles​

From highest to lowest rank:

  • Owner — full control of the account.
  • Admin — manage everything within scope except account ownership.
  • Editor — create, read and edit diagrams.
  • Viewer — read-only.

Scopes​

Permissions apply at a scope. From broadest to narrowest:

Account → Organization → Workspace → Team → (diagrams)

A role granted at a higher scope cascades to everything beneath it. Grant Editor at the organization scope and the member can edit diagrams in every workspace and team within that organization.

Permission matrix​

CapabilityOwnerAdminEditorViewer
Read account✓✓✓✓
Manage account / SSO / members✓✓——
Create / manage organization✓✓——
Create / manage workspace✓✓——
Create / manage team✓✓——
Diagram — create✓✓✓—
Diagram — read✓✓✓✓
Diagram — write✓✓✓—
Diagram — delete✓✓✓—

In short: Owner and Admin manage everything within their scope; Editor works with diagrams but can't manage structure or members; Viewer is read-only.

Key rules​

  • Tenant isolation — there is no access across accounts. Every cross-account request is denied, full stop.
  • Role-rank assignment — you can't grant a role at or above your own rank (an admin can't create an owner or another admin).
  • Feature entitlements — enterprise capabilities are gated by entitlements: sso, scim, audit-log and db-per-tenant. A role alone doesn't unlock a feature your tier doesn't include.

:::warning Enforced server-side All of these checks run on the server and on the realtime websocket — never merely hidden in the UI. A gated feature is a permission check, not an invisible button, so the boundary holds even for direct API calls. See the REST API. :::