# Manage permissions (RBAC)

import { Steps } from "@astrojs/starlight/components"

Mindflow uses **role-based access control (RBAC)**. Each person (or team) gets a role on an organization, a flow, or an
environment. The role decides what they can view, edit, run, or manage. This page explains the roles and how to grant
them on flows and environments. Organization membership is covered in [Manage users](../manage-users/); grouping people
for shared grants is covered in [Manage teams](../manage-teams-and-group-permissions/).

## When to use

- You need to know what **Org Admin**, **Org Member**, flow roles, or environment roles allow.
- You want to grant a person (or team) access to a specific flow or environment.
- Prefer [Manage users](../manage-users/) when you only need to add someone to the organization or change Org Admin
  versus Org Member.
- Prefer [Manage teams](../manage-teams-and-group-permissions/) when several people should share the same grants.

Before you begin, you need permission to manage the resource you are sharing (for example **Flow Owner** or
**Environment Owner**), or **Org Admin** rights for organization-wide changes.

## Guide

### Organization roles

Every user in the organization has one organization role. **Org Admin** can manage the whole organization.
**Org Member** works on resources only where they have an explicit flow, environment, or team grant.

| Organization role | Permissions                                                                                                                                                                                                                  |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Org Admin**     | View and edit organization settings; manage organization members; create flows and environments; create teams; manage credentials in the global environment; full access to flows and environments in the organization.      |
| **Org Member**    | View organization membership; create flows; create environments when **Allow members to create environments** is on; view global-environment credentials; act on flows, environments, and teams only with an explicit grant. |

Assign organization roles on **Organization** → **Members**. See [Manage users](../manage-users/).

### Flow roles

Flow roles control who can open, edit, delete, and share a flow. Assign them on the flow’s **Flow permissions** dialog
(users or teams).

| Flow role       | What they can do                                                                                              |
| --------------- | ------------------------------------------------------------------------------------------------------------- |
| **Flow Owner**  | View, edit, and delete the flow; manage who else has access (except the last owner cannot remove themselves). |
| **Flow Editor** | View and edit the flow; remove their own access. Cannot delete the flow or manage other people’s permissions. |
| **Flow Viewer** | View the flow and its audit history; remove their own access. Cannot edit or delete the flow.                 |

Deploying or running a flow also requires an environment role that allows deploy or run (**Environment Owner** or
**Environment Operator**), plus any of the three flow roles on that flow.

### Environment roles

Environment roles control the environment itself, its credentials, deployments, run logs, and AI··Rooms in that space.

| Environment role         | What they can do                                                                                                                                                                                                                  |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Environment Owner**    | View, edit, and delete the environment; create, edit, and delete credentials; deploy, configure, run, and undeploy flows; manage AI··Rooms; manage who else has access (except the last owner cannot remove themselves).          |
| **Environment Operator** | View the environment and its credentials; deploy, configure, run, and undeploy flows; manage AI··Rooms; remove their own access. Cannot edit or delete the environment, manage credentials, or change other people’s permissions. |
| **Environment Auditor**  | View the environment, credentials, deployments, run logs, and AI··Rooms; remove their own access. Cannot deploy, run, or change configuration.                                                                                    |

Credential secret values are never revealed after creation, even when a role can edit a credential.

### Grant access to a flow

Use **Edit permissions…** on a flow when one person or team needs Owner, Editor, or Viewer on that flow. From the
designer, you can also open the same permissions controls in the page header without leaving the canvas.

1. **Open Flows.** In Studio, go to **Flows**.
2. **Open Flow permissions.** On the flow card menu, choose **Edit permissions…**. Or open the flow in the designer and
   use the permissions control in the page header.

   <div class="docs-screenshot-compact">

   ![Designer flow permissions popover with Flow owner, Flow editor, and Flow viewer roles](./assets/designer-flow-permissions-popover.png)

   </div>

3. **Add a person or team.** Search for the user or team, choose **Flow Owner**, **Flow Editor**, or **Flow Viewer**,
   then choose **Add**.
4. **Adjust or remove.** Change the role on an existing row, or remove access when it is no longer needed.

### Grant access to an environment

Use **Members** on an environment when someone needs Owner, Operator, or Auditor in that space.

1. **Open the environment.** Go to **Environments** and open the environment.
2. **Add a member.** In **Members**, choose **Add member**.
3. **Assign the role.** Select a user or team, choose **Environment Owner**, **Environment Operator**, or
   **Environment Auditor**, then confirm.
4. **Adjust or remove.** Change the role on an existing row, or remove the member when access should end.

## Example

A builder needs to edit a phishing flow and run it in production, without becoming an Org Admin.

1. **Keep Org Member.** Leave the builder as **Org Member** on Organization → Members.
2. **Grant the flow.** On **Phishing triage**, add the builder as **Flow Editor**.
3. **Grant the environment.** On **Production**, add the builder as **Environment Operator**.

They can edit the flow and deploy or run it in Production. They cannot manage organization settings or other people’s
permissions on those resources.

## Keep in mind

- Grant only the access someone needs for the job (**least privilege**). Prefer **Org Member** plus specific flow and
  environment roles over making everyone an **Org Admin**.
- Review membership and roles when people change jobs or leave. Remove unused grants.
- Do not use the only **Org Admin**, **Flow Owner**, or **Environment Owner** account for everyday building—keep at
  least one owner, and use a separate Org Member for routine work when you can.
- Teams inherit the same flow and environment role meanings as individual users. See
  [Manage teams](../manage-teams-and-group-permissions/).

## Related

- [Manage users](../manage-users/)
- [Manage teams](../manage-teams-and-group-permissions/)
- [Administrating the platform](../../administrating-the-platform/)