Roles and permissions
What each built-in role can do, every permission, and custom roles.
Everything in Cueston checks permissions, not role names. API keys, the CLI and AI agents act with the current permissions of the person they belong to.
Built-in roles
| Role | Who it's for |
|---|---|
| Owner | Everything, including billing and deleting the workspace. One per workspace. |
| Admin | Everything except billing and deleting the workspace. |
| Member | Builds, publishes and analyses content. |
| Contributor | Builds drafts and requests review; can't publish. |
| Viewer | Read-only access to content and analytics. |
Permissions
| Permission | Allows | Owner | Admin | Member | Contributor | Viewer |
|---|---|---|---|---|---|---|
content.view | See tours, tooltips, banners and their settings | ✓ | ✓ | ✓ | ✓ | ✓ |
content.edit | Create and edit drafts, and preview them | ✓ | ✓ | ✓ | ✓ | |
content.publish | Publish, unpublish and roll back content, and approve publish requests | ✓ | ✓ | ✓ | ||
content.delete | Delete content | ✓ | ✓ | ✓ | ||
analytics.view | See analytics | ✓ | ✓ | ✓ | ✓ | ✓ |
analytics.export | Export analytics data | ✓ | ✓ | ✓ | ||
team.manage | Invite and remove members and change their roles | ✓ | ✓ | |||
workspace.settings | Change workspace settings, domains, features and publishable keys | ✓ | ✓ | |||
api_keys.manage | See and revoke every member's API keys | ✓ | ✓ | |||
audit.view | See the audit log | ✓ | ✓ | |||
security.manage | Manage single sign-on, SCIM, identity verification and roles | ✓ | ✓ | |||
billing.manage | Manage the subscription | ✓ | ||||
workspace.delete | Delete the workspace or transfer ownership | ✓ |
Custom roles
In Settings → Team & roles, create roles with any set of permissions, for example a "Publisher" who can publish but not delete, or an "Analyst" who only sees and exports analytics. A workspace can have up to 50 custom roles. billing.manage and workspace.delete belong to the owner only and can't be part of a custom role.
With SCIM, your identity provider's groups can decide each person's role.