Roles¶

Each member of a company has one of three roles in it. The Members page describes them so:

Role	In one line
Owner	Everything an admin does, and the company's retention and who else is an owner.
Admin	Sets the company up: systems and their credentials, service accounts, groups, budgets, runner hosts and the model gateway.
Member	Talks to agents, defines agents and triggers, and connects their own accounts and runner host.

A role belongs to one company. The same person can be an Owner in one company and a Member in another.

Who may do what¶

Task	Owner	Admin	Member
Talk to agents, make agents, write triggers	Yes	Yes	Yes
Connect your own accounts, add a personal runner host	Yes	Yes	Yes
Add your own MCP servers, when the company allows it	Yes	Yes	Yes
See and edit every agent and trigger	Yes	Yes	Only their own; agents shared with them, to use; triggers whose team they are in, to see, run and pause
Register systems, add and lend their credentials	Yes	Yes	No
Manage service accounts and groups	Yes	Yes	No
Set the model gateway and budgets	Yes	Yes	No
Register company runner hosts	Yes	Yes	No
Manage the company's secrets	Yes	Yes	No
Add, suspend and remove members	Yes	Yes, except Owners	No
Stop all of the company's runs, pause systems	Yes	Yes	No
Pause agents and triggers	Every one	Every one	Their own agents; triggers they wrote or whose team they are in
Read the audit log	Yes	Yes	No
See spend	Every run; another person's personal conversation by its key, without its title	Every run; other people's personal conversations summed per person	Their own, and their triggers'
Read other people's conversations	Yes, in full; each read is recorded and shown to the person	No	No
Appoint or remove Owners	Yes	No	No
Change retention, set legal holds, erase a person's content	Yes	No; reads the retention periods	No

A company always keeps at least one active Owner: the last one cannot be removed, demoted or suspended.

Groups¶

A group is a named set of members. It is not a role and never takes rights away: it adds to what its members' roles allow. A group can:

receive credentials that systems lend it;
be allowed to use a service account in triggers;
have agents and skills shared with it;
be a trigger's team.

Instance admins¶

An instance admin manages the Tinfirm installation itself: its users and companies. This is a flag on the person, separate from company roles.

An instance admin who is a member of a company acts there by their role, like anyone else. One who opens a company they are not a member of gets an Admin's view of it, and the opening is recorded in the company's audit log. That view cannot read people's conversations. Its one addition is that it can appoint an Owner, for a company that has no Owner left to reach.