# Roles and permissions

> Everyone in an organisation has one of four fixed roles: Owner, Admin, Member or Viewer. A role applies to every project in the organisation.

> **In short**
>
> - There are four fixed roles: **Owner**, **Admin**, **Member** and **Viewer**.
> - A role applies to every project in the organisation. There are no per-project roles.
> - Owners and admins manage members, projects, keys, access tokens and settings. Only an owner can delete the organisation or manage other owners.
> - A viewer is not read-only. A viewer can start AI judging and give 👍/👎.
> - You cannot suspend a person. To end their access, remove them.

## What it is for

Use this page to choose a role for each person. For typical cases, see **Typical cases** below.

## How roles work

- **A role belongs to the organisation.** There are no per-project roles and no custom roles.
- **To limit a person to some projects, put those projects in a different organisation.** See **Limits** for when the app lets you create one.
- **A person has one role in each organisation.** The project switcher shows your role next to the name of each organisation.
- **The person who creates the organisation is its first owner.**

### Typical cases

| Case | What to do |
|---|---|
| A contractor must open replays but not change settings. | Give them **Viewer**. They see every project in the organisation, not only their project. |
| You want to move an app to a new ingest key and turn off the old key. | An owner or an admin can rotate the key. |
| Your support lead wants to add a question to the rubric. | They need **Admin** or **Owner**. |
| A CI job must mark releases. | An owner or an admin creates an access token with the `releases:write` scope. |
| A person left the company. | An owner or an admin removes them. If the person was an owner, another owner must remove them. Sequential also ends the claude.ai connections that the person made. |
| An admin becomes a member or viewer. | Sequential ends the claude.ai connections that they made in this organisation. Giving the role back does not bring them back. See [Connect claude.ai](/docs/connect-claude-ai). |

### More about how roles work

- A viewer is a viewer on every project in the organisation.
- A person can belong to several organisations.
- **The server checks every request.** The screens hide or disable most actions that your role cannot do. If a request comes in for one of these actions anyway, the server refuses it.

### How Settings picks the organisation

Settings shows one organisation at a time. The tabs you see, the **Organisation** page and your role there all follow the organisation of the project picked in the switcher.

To change roles in another organisation, or to leave it, first pick one of its projects in the switcher. You cannot pick an organisation this way if it has no projects, or only archived projects.

### What people outside the organisation see

Sequential gives someone outside your organisation the same answer for your projects as for projects that do not exist. They cannot find which of your projects exist.

## What each role can do

| What you can do | Owner | Admin | Member | Viewer |
|---|:-:|:-:|:-:|:-:|
| See analytics, sessions, replays, **Watch**, **Ask**, **Heatmaps**, the rubric, **Calibration**, recording settings and **Setup**; give 👍/👎 | ✓ | ✓ | ✓ | ✓ |
| See and copy ingest keys | ✓ | ✓ | ✓ | — |
| Save, rename and delete the project's saved filters, funnels and flows | ✓ | ✓ | ✓ | — |
| Change the rubric, recording settings, projects and keys; manage access tokens and members; read the **Audit log** | ✓ | ✓ | — | — |
| Delete the organisation | ✓ | — | — | — |

The full list is in **Full permission table** below.

- Only an owner can invite a person as an owner, make a person an owner, or change or remove an owner.
- Nobody can remove the only owner or change their role. The only owner cannot leave the organisation.
- Every person, whatever their role, manages their own **Profile** and **Security** settings. Every person can also send feedback to the Sequential team and see their own feedback under **Settings** → **Feedback**.
- Sequential staff can also make support changes: change a project's settings, archive or restore a project, revoke an ingest key or an access token, and turn the two-factor requirement on or off. The [audit log](/docs/audit-log#changes-by-sequential-support) names them "Sequential support". It never shows the name of the staff member.

### Full permission table

| What you can do | Owner | Admin | Member | Viewer |
|---|:-:|:-:|:-:|:-:|
| See events, funnels, flows, retention, users, entities (accounts) and sessions | ✓ | ✓ | ✓ | ✓ |
| Apply the project's saved filters, funnels and flows | ✓ | ✓ | ✓ | ✓ |
| Save, rename and delete saved filters, funnels and flows, also those that someone else saved | ✓ | ✓ | ✓ | — |
| Use **Watch** and **Ask** | ✓ | ✓ | ✓ | ✓ |
| Give 👍/👎 on verdicts | ✓ | ✓ | ✓ | ✓ |
| Open replays and a replay's **Insights** tab | ✓ | ✓ | ✓ | ✓ |
| See the rubric (the project's **Insights** tab) and **Calibration** | ✓ | ✓ | ✓ | ✓ |
| Edit or reset the rubric, and use **Try it** | ✓ | ✓ | — | — |
| See recording settings (the **Session replay** tab) | ✓ | ✓ | ✓ | ✓ |
| Change recording settings | ✓ | ✓ | — | — |
| See the project list, **Overview** and **Setup** | ✓ | ✓ | ✓ | ✓ |
| Create a project | ✓ | ✓ | — | — |
| Rename, archive, restore or delete a project, or change its environment (the **Danger** tab) | ✓ | ✓ | — | — |
| See and copy ingest keys: **Sources & keys**, and the install snippet and **Install with your AI agent** on **Setup** | ✓ | ✓ | ✓ | — |
| Create, rotate and revoke keys; register a Pendo API key | ✓ | ✓ | — | — |
| See, create and revoke access tokens (the **Access tokens** tab and the **Agents** page), see the **Connect an agent** card on the **Access tokens** tab, and see agent activity | ✓ | ✓ | — | — |
| Connect claude.ai to a project, and disconnect or cancel a connection on **Agents** | ✓ | ✓ | — | — |
| Create an agent token in onboarding, or with **Add an agent access token to this prompt** on **Setup** | ✓ | ✓ | — | — |
| Set a verdict on a finding: **Confirm problem**, **Dismiss…** (**Not a problem** or **Won't fix**) or **Reopen** | ✓ | ✓ | ✓ | — |
| Hand a finding to your coding agent with **Draft a fix** | ✓ | ✓ | — | — |
| See the **Organisation** settings tab | ✓ | ✓ | — | — |
| Invite people and resend invitations | ✓ | ✓\* | — | — |
| Cancel invitations | ✓ | ✓ | — | — |
| Change members' roles | ✓ | ✓\* | — | — |
| Remove members | ✓ | ✓\* | — | — |
| Rename the organisation; turn **Require two-factor authentication** on or off | ✓ | ✓ | — | — |
| Delete the organisation | ✓ | — | — | — |
| Read the **Audit log** and a project's **Recent changes** | ✓ | ✓ | — | — |

\* An admin cannot do this for an owner. Only an owner can invite a person as an owner, make a person an owner, or change or remove an owner. For an admin, **Owner** is greyed out in the role list.

### Role descriptions in the app

When you invite a person, the app shows a description of the selected role under the **Role** list:

| Role | In the app |
|---|---|
| **Owner** | "Full control, including deleting the organisation." |
| **Admin** | "Manages members, projects, keys and settings." |
| **Member** | "Explores analytics and replays, can use AI." |
| **Viewer** | "Read-only access to analytics and replays." |

Viewer is not read-only. See **Cases to know about** below.

## Change someone's role

1. Open Settings → **Organisation**. Only owners and admins see this tab.
2. In the **Members** card, find the person. To find them fast, type a name or an email in **Find a member…**.
3. Pick a new role from the list in their row. "Role updated" confirms the change.

The new role applies from the person's next request. They do not need to sign out. Their tabs and buttons change only when they reload the page.

### What the Members card shows

From 13 October 2026:

- Owners and admins see each member's **Role**, **Two-factor** (**On** or **Off**), **Last active** and **Joined**.
- **Last active** is a day: "Today", "Yesterday", "3 days ago" or "Over 30 days ago". It never shows a time or a device. Sequential records sign-ins only from 11 October 2026. So "No sign-in recorded" does not mean that the person never signed in.
- Members and viewers who open `/settings/organization` see only **Member**, **Role** and **Joined**. Sequential does not send them the other columns.
- On a phone, each member is a card. It says "Two-factor on" or "Two-factor off".
- The **Members** card ends with **Require two-factor authentication**. See [Two-factor authentication and account security](/docs/two-factor-and-security).

To choose a role before a person joins, pick it in the **Role** list when you invite them. The default is **Member**. See [Sign-up and invitations](/docs/sign-up-and-invitations).

### Hand over ownership

There is no transfer button. Do these steps:

1. As an owner, change the new person's role to **Owner**.
2. Ask the new owner to change your role, or leave the organisation. You cannot change your own role.

To leave, see **Leave an organisation** below. Keep at least two owners. Then the organisation does not depend on one person's account.

### When a role change is refused or locked

If Sequential refuses the change, the list goes back to the old role. A message says why.

The role list in a row is locked in these cases. Its tooltip says why:

| Case | Tooltip |
|---|---|
| It is your own row | "You cannot change your own role" |
| It is the only owner | "The only owner — make someone else an owner first" |
| It is an owner, and you are an admin | "Only an owner can change an owner" |

## Remove someone

1. Open Settings → **Organisation** → **Members**.
2. In the person's row, click **Remove**.
3. Click **Confirm**. "Member removed" confirms it.

From their next request, the person cannot open anything in your organisation. Nobody can remove the only owner. Sequential shows "The only owner cannot be removed".

### What stays after you remove someone

- Their Sequential account and their other organisations do not change.
- Their past entries stay in the [Audit log](/docs/audit-log), with a short id instead of their name.
- Only an owner can remove an owner.

### Leave an organisation

Any person except the only owner can leave.

1. If you belong to several organisations, pick one of this organisation's projects in the switcher.
2. If you are an owner or admin, open Settings → **Organisation**.
3. If you are a member or viewer, go to `/settings/organization`. You do not have an **Organisation** tab.
4. In **Danger zone**, click **Leave organisation**.
5. Click the **Leave …** button that shows the name of your organisation.

You lose access to every project in the organisation. An owner or an admin can invite you again.

## Cases to know about
- Only owners and admins can switch background judging off or on, under **Settings** → **Projects** → your project → **Insights**. Members and viewers see the switch, but they cannot change it.
- **Ask** in the app and background judging have separate daily allowances. Heavy use of **Ask** does not stop background judging.

> **A viewer is not read-only**
>
> Every role, **Viewer** included, can start AI judging and give 👍/👎 on verdicts. Opening a replay's **Insights** tab starts AI judging, also through **Watch from …** and **Watch from here**. AI judging uses the project's allowances. The allowances are per project, not per person. So one person can use all of the day's allowance for the whole team.

- **A viewer's 👍/👎 counts the same as an admin's.** It feeds the project's **Calibration** tab. See [Feedback and calibration](/docs/feedback-and-calibration).
- **The two-factor requirement applies to every role.** When **Require two-factor authentication** is on, Sequential blocks a person from the organisation's projects unless they have two-factor set up and signed in with a code or a trusted device. See [Two-factor authentication and account security](/docs/two-factor-and-security).

### AI judging and allowances

- **Viewers can start AI judging.** Opening a replay's **Insights** tab judges the session, unless a saved judgment matches. **Re-run** and **Ask** also use an allowance. See [Session insights](/docs/session-insights) and [Ask](/docs/ask).
- **Watch from …** on a Watch row and **Watch from here** in Ask both open the replay on **Insights**.
- **Re-run** judges the session again, at most once every 10 minutes per session.
- When you open **Insights** or click **Re-run**, Sequential uses the project's daily on-demand allowance.
- **Ask** uses a separate daily allowance. Background judging has its own.
- Every role can do all three of these actions: open **Insights**, click **Re-run** and use **Ask**.

### Feedback and two-factor details

- Any role can agree or disagree with a verdict on **Watch**.
- Each person's latest answer feeds the project's **Calibration** tab and the feedback in the rubric editor.
- The two-factor block stays until the person has set up two-factor authentication and signed in with a code or a trusted device.

### Saved filters, funnels and flows by role

- Saved items belong to the project, not to the person who saved them. Owners, admins and members can rename and delete any of them.
- Viewers see and apply saved items. They do not see the rename (✎) and delete (**×**) buttons. When a viewer tries to save, a message says, for example, "Your role can apply saved filters but not change them."
- Viewers do not get the offer to move saved items from their browser into the project.
- See [Filters, date ranges and saved views](/docs/filters-and-saved-views).

### Keys and access tokens by role

- **Members can copy ingest keys but not manage them.** Ingest keys are not secrets, because your site's pages contain them. This rule only controls who manages the install. See [Organisations, projects and keys](/docs/organisations-and-projects).
- **Viewers do not see the keys.** Viewers do not get the **Sources & keys** tab. On **Setup**, they see "The install snippet needs a member, admin or owner — ask one for the keys." in place of the snippet.
- **Only owners and admins see access tokens.** Members and viewers do not get the **Access tokens** tab or the **Connect an agent** card. If they open the page's address, they see "Access tokens are for admins" and "Ask an admin or owner to create a token for your agent."
- **A token cannot manage tokens.** To create or revoke a token, an owner or admin must be signed in.
- **Only owners and admins can read agent activity.** GET `/api/projects/:id/agent-activity` gives the tool calls of the project's tokens. It needs the same permission as the token list, and a signed-in session. The **Agents** page shows it too. See [Limits](/docs/limits).
- **Every role can see whether an agent is connected.** GET `/api/projects/:id/status` gives every role that can read the project `agent.connected` and `agent.regular`. `connected` says whether a token that counts as an agent exists. `regular` says whether one such token called Sequential on 3 or more of the last 7 days. The answer has no token names, ids, dates or counts. A value that Sequential could not read is `null`.
- **Only owners and admins see Agents.** Members and viewers do not get **Agents** in the rail or in the search. If they open `/agents`, they see "Agents are for admins" and "Ask an admin or owner to see this project's agent tokens and activity." In onboarding, they see "Connecting an agent needs an admin" and "An owner or admin connects Claude and ChatGPT for this project." They do not get **Add an agent access token to this prompt** on **Setup**. In the setup checklist on **Dashboard**, step 2 says "An agent is connected" or "No agent connected yet · an owner or admin connects agents for this project." for them. Step 3 says "An agent calls Sequential most days" or "Not yet a regular · an owner or admin sets this up."
- **A token can never set a verdict.** A verdict on a finding needs a person. See [Limits](/docs/limits).

## Limits

- There are four fixed roles. You cannot create custom roles or give a person a role on one project only.
- You cannot suspend a person. Removing them is the only way to end their access.
- Owners and admins cannot reset the password or two-factor authentication of another member. They cannot sign out another member's devices.
- An organisation can have up to 100 members and 100 pending invitations.
- If you are an owner or admin of an organisation, you cannot create a second organisation from the app.
- Members and viewers have no **Organisation** tab. To leave an organisation, they go to `/settings/organization`.
- You cannot change roles in an organisation, or leave it, from Settings if it has no projects or only archived projects.
- An access token cannot create or revoke tokens. It cannot set a verdict on a finding. These actions need a signed-in person.

## Related

- [Organisations, projects and keys](/docs/organisations-and-projects)
- [Limits](/docs/limits)
- [Sign-up and invitations](/docs/sign-up-and-invitations)
- [Two-factor authentication and account security](/docs/two-factor-and-security)
- [Audit log](/docs/audit-log)
- [Session insights](/docs/session-insights)
- [Ask: find sessions by describing them](/docs/ask)
- [Feedback and calibration](/docs/feedback-and-calibration)
- [Customise the rubric](/docs/rubric)
- [Recording settings](/docs/recording-settings)