Roles Permissions
Roles and permissions (reference)
This page lists who can do what inside a workspace. A role is a job title with a badge: it is not the person’s name, it is the permission pack they wear. In CROForge roles are an enum: Owner 0, Admin 1, Member 2. A separate user status enum says whether that person is allowed to sign in at all (Active, Inactive, Terminated).
The matrix below is product intent. If the backend enforces different rules, treat the API as the source of truth. Doc ID: ref.roles. Audience: both.
Words used on this page
| Word | Everyday meaning | Meaning in CROForge |
|---|---|---|
| Role | A job title that comes with a set of keys to the building. | USER_ROLES in lib/enums.ts: Owner 0, Admin 1, Member 2. Assigned per workspace. |
| Permission | Whether you are allowed to do a specific action (invite, bill, edit). | Product matrix below. Billing/ownership is Owner-only; invite/remove is Owner and Admin; Members can still create/edit experiments and Data Vista objects. |
| Owner | The person who “owns” the account—billing and transfer sit with them. | Enum 0. Full capability including manage billing / ownership transfer. |
| Admin | A trusted operator who can manage people and settings but not own billing. | Enum 1. Invite/remove users, change workspace settings, full experiment and Data Vista edit. |
| Member | A teammate who does the day-to-day testing work. | Enum 2. Create/edit experiments and Data Vista; limited settings and activity-log access. |
| User status | Whether this person is still allowed in, paused, or permanently out. | USER_STATUS: Active 0, Inactive 1, Terminated 2. |
| Active | The account is on; they can sign in. | USER_STATUS.ACTIVE = 0. |
| Inactive | Temporarily switched off (like a suspended badge). | USER_STATUS.INACTIVE = 1. |
| Terminated | Permanently ended—no longer part of the org. | USER_STATUS.TERMINATED = 2. |
| Enum | A labeled list of allowed numbers in code. | Roles and user statuses are numeric enums so UI, API, and docs stay aligned. |
Screenshot filename
Suggested screenshot filename: workspace-users.png. Capture the workspace users list with role badges. Insert the real image from the WordPress Media Library in place of this note.
Roles (USER_ROLES)
| Role | Value |
|---|---|
| Owner | 0 |
| Admin | 1 |
| Member | 2 |
Practical matrix (product intent)
Checkmarks mean the role can do the action. A dash means they cannot. “Limited” means some screens or fields are visible but not fully editable.
| Capability | Owner | Admin | Member |
|---|---|---|---|
| Manage billing / ownership transfer | ✓ | — | — |
| Invite/remove users | ✓ | ✓ | — |
| Change workspace settings | ✓ | ✓ | limited |
| Create/edit experiments | ✓ | ✓ | ✓ |
| Edit Data Vista objects | ✓ | ✓ | ✓ |
| View activity logs | ✓ | ✓ | limited |
Adjust this table if the backend enforces different rules; treat the API as the source of truth.
User statuses (USER_STATUS)
Role answers “what keys do they have?” Status answers “is the badge still valid?”
| Status | Enum value | Meaning |
|---|---|---|
| Active | 0 | Can sign in and work according to their role |
| Inactive | 1 | Temporarily disabled |
| Terminated | 2 | Permanently removed |
