# User management

A Cerbos Hub user can have a role at the organization level and an optional set of roles for each workspace. All of these roles are considered when determining the permissions for any particular user.

## Organization roles

Organization roles, except for the `Member` role, apply to all workspaces within the organization. Users with organizational role of `Member` must be explicitly granted workspace roles in order to access a workspace.

| Action                    | Owner | Developer | Analyst | Viewer | Member |
|---------------------------|-------|-----------|--------|--------|--------|
| View organization          | ✅   | ✅       | ✅      | ✅      | ✅      |
| Modify organization        | ✅   | ❌       | ❌      | ❌      | ❌      |
| Manage members             | ✅   | ❌       | ❌      | ❌      | ❌      |
| Invite a member           | ✅   | ❌       | ❌      | ❌      | ❌      |
| Create a workspace        | ✅   | ✅       | ✅      | ✅      | ✅      |
| Create a playground       | ✅   | ✅       | ✅      | ✅      | ✅      |
| Update a playground       | ✅   | ✅       | ✅      | ✅      | ✅      |
| Delete a playground       | ✅   | ✅       | ✅      | ✅      | ✅      |
| Export a playground       | ✅   | ✅       | ✅      | ✅      | ✅      |
| Connect a PDP to a playground | ✅   | ✅       | ✅      | ✅      | ✅      |

## Workspace Roles

Permissions assigned at the organization level are inherited by all workspaces. Additionally, a user can be assigned specific roles within a workspace, potentially granting more permissions for that particular workspace only.

| Action                       | Owner | Developer | Analyst | Viewer |
|------------------------------|-------|-----------|--------|--------|
| View a workspace              | ✅   | ✅       | ✅      | ✅      |
| View builds                  | ✅   | ✅       | ✅      | ✅      |
| View decision points         | ✅   | ✅       | ✅      | ✅      |
| View issues                  | ✅   | ✅       | ✅      | ✅      |
| View audit logs              | ✅   | ❌       | ✅      | ❌      |
| Manage API keys              | ✅   | ✅       | ❌      | ❌      |
| Reset encryption key         | ✅   | ❌       | ❌      | ❌      |
| Manage workspace members      | ✅   | ❌       | ❌      | ❌      |
| Modify workspace             | ✅   | ❌       | ❌      | ❌      |
| Delete a workspace           | ✅   | ❌       | ❌      | ❌      |

## Deleting an organization

Organizations can be deleted by navigating to the organization settings page and clicking **Delete organization**. This action is irreversible and permanently deletes all data associated with the organization, including all workspaces, policy stores, deployments, and audit logs.