User management :: Cerbos Authorization Management Platform // Documentation

User management

A Cerbos Hub user can have a role at the organization level and an optional set of roles for each workspace. All of these roles are considered when determining the permissions for any particular user.

Organization roles

Organization roles, except for the Member role, apply to all workspaces within the organization. Users with organizational role of Member must be explicitly granted workspace roles in order to access a workspace.

Action	Owner	Developer	Analyst	Viewer	Member
View organization	✅	✅	✅	✅	✅
Modify organization	✅	❌	❌	❌	❌
Manage members	✅	❌	❌	❌	❌
Invite a member	✅	❌	❌	❌	❌
Create a workspace	✅	✅	✅	✅	✅
Create a playground	✅	✅	✅	✅	✅
Update a playground	✅	✅	✅	✅	✅
Delete a playground	✅	✅	✅	✅	✅
Export a playground	✅	✅	✅	✅	✅
Connect a PDP to a playground	✅	✅	✅	✅	✅

Workspace Roles

Permissions assigned at the organization level are inherited by all workspaces. Additionally, a user can be assigned specific roles within a workspace, potentially granting more permissions for that particular workspace only.

Action	Owner	Developer	Analyst	Viewer
View a workspace	✅	✅	✅	✅
View builds	✅	✅	✅	✅
View decision points	✅	✅	✅	✅
View issues	✅	✅	✅	✅
View audit logs	✅	❌	✅	❌
Manage API keys	✅	✅	❌	❌
Reset encryption key	✅	❌	❌	❌
Manage workspace members	✅	❌	❌	❌
Modify workspace	✅	❌	❌	❌
Delete a workspace	✅	❌	❌	❌

Deleting an organization

Organizations can be deleted by navigating to the organization settings page and clicking Delete organization. This action is irreversible and permanently deletes all data associated with the organization, including all workspaces, policy stores, deployments, and audit logs.