Roles and permissions

• A viewer is a viewer on every project in the organisation.
• A person can belong to several organisations.
• The server checks every request. The screens hide or disable most actions that your role cannot do. If a request comes in for one of these actions anyway, the server refuses it.

Settings shows one organisation at a time. The tabs you see, the Organisation page and your role there all follow the organisation of the project picked in the switcher.

To change roles in another organisation, or to leave it, first pick one of its projects in the switcher. You cannot pick an organisation this way if it has no projects, or only archived projects.

Sequential gives someone outside your organisation the same answer for your projects as for projects that do not exist. They cannot find which of your projects exist.

* An admin cannot do this for an owner. Only an owner can invite a person as an owner, make a person an owner, or change or remove an owner. For an admin, Owner is greyed out in the role list.

When you invite a person, the app shows a description of the selected role under the Role list:

Viewer is not read-only. See Cases to know about below.

If Sequential refuses the change, the list goes back to the old role. A message says why.

The role list in a row is locked in these cases. Its tooltip says why:

• Their Sequential account and their other organisations do not change.
• Their past entries stay in the Audit log, with a short id instead of their name.
• Only an owner can remove an owner.

Any person except the only owner can leave.

1. If you belong to several organisations, pick one of this organisation's projects in the switcher.
2. If you are an owner or admin, open Settings → Organisation.
3. If you are a member or viewer, go to /settings/organization. You do not have an Organisation tab.
4. In Danger zone, click Leave organisation.
5. Click the Leave … button that shows the name of your organisation.

You lose access to every project in the organisation. An owner or an admin can invite you again.

• Viewers can start AI judging. Opening a replay's Insights tab judges the session, unless a saved judgment matches. Re-run and Ask also use an allowance. See Session insights and Ask.
• Watch from … on a Watch row and Watch from here in Ask both open the replay on Insights.
• Re-run judges the session again, at most once every 10 minutes per session.
• When you open Insights or click Re-run, Sequential uses the project's daily on-demand allowance.
• Ask uses a separate daily allowance. Background judging has its own.
• Every role can do all three of these actions: open Insights, click Re-run and use Ask.

• Any role can agree or disagree with a verdict on Watch.
• Each person's latest answer feeds the project's Calibration tab and the feedback in the rubric editor.
• The two-factor block stays until the person has set up two-factor authentication and signed in with a code or a trusted device.

• Saved items belong to the project, not to the person who saved them. Owners, admins and members can rename and delete any of them.
• Viewers see and apply saved items. They do not see the rename (✎) and delete (×) buttons. When a viewer tries to save, a message says, for example, "Your role can apply saved filters but not change them."
• Viewers do not get the offer to move saved items from their browser into the project.
• See Filters, date ranges and saved views.

• Members can copy ingest keys but not manage them. Ingest keys are not secrets, because your site's pages contain them. This rule only controls who manages the install. See Organisations, projects and keys.
• Viewers do not see the keys. Viewers do not get the Sources & keys tab. On Setup, they see "The install snippet needs a member, admin or owner — ask one for the keys." in place of the snippet.
• Only owners and admins see access tokens. Members and viewers do not get the Access tokens tab or the Connect an agent card. If they open the page's address, they see "Access tokens are for admins" and "Ask an admin or owner to create a token for your agent."
• A token cannot manage tokens. To create or revoke a token, an owner or admin must be signed in.
• Only owners and admins can read agent activity. GET /api/projects/:id/agent-activity gives the tool calls of the project's tokens. It needs the same permission as the token list, and a signed-in session. The Agents page shows it too. See Limits.
• Every role can see whether an agent is connected. GET /api/projects/:id/status gives every role that can read the project agent.connected and agent.regular. connected says whether a token that counts as an agent exists. regular says whether one such token called Sequential on 3 or more of the last 7 days. The answer has no token names, ids, dates or counts. A value that Sequential could not read is null.
• Only owners and admins see Agents. Members and viewers do not get Agents in the rail or in the search. If they open /agents, they see "Agents are for admins" and "Ask an admin or owner to see this project's agent tokens and activity." In onboarding, they see "Connecting an agent needs an admin" and "An owner or admin connects Claude and ChatGPT for this project." They do not get Add an agent access token to this prompt on Setup. In the setup checklist on Dashboard, step 2 says "An agent is connected" or "No agent connected yet · an owner or admin connects agents for this project." for them. Step 3 says "An agent calls Sequential most days" or "Not yet a regular · an owner or admin sets this up."
• A token can never set a verdict. A verdict on a finding needs a person. See Limits.