OrganizationsRoles and permissions

Roles and Permissions

Every member of an organization has exactly one role. The role decides what that member can see and do. Surplus enforces every role on the backend, so a member can only ever do what their role permits.

The roles at a glance

Role	What it is for
Owner	Full access to everything, including billing.
Admin	Runs the organization day to day: members, workspaces, keys, offers, and settings. Cannot manage billing or withdraw money.
Billing admin	Owns the money: billing, wallets, budgets, and payouts (including withdrawals). Does not manage keys or members.
Developer	Builds and spends: API keys, offers, and spending. Cannot see the organization's bill.
Analyst	Read-only across usage, audit, finance, and request logs. Cannot spend or change anything.
Member	Spends from credit and views their own usage.
Viewer	Views their own usage only.

OwnerWhat it is for · Full access to everything, including billing.

AdminWhat it is for · Runs the organization day to day: members, workspaces, keys, offers, and settings. Cannot manage billing or withdraw money.

Billing adminWhat it is for · Owns the money: billing, wallets, budgets, and payouts (including withdrawals). Does not manage keys or members.

DeveloperWhat it is for · Builds and spends: API keys, offers, and spending. Cannot see the organization's bill.

AnalystWhat it is for · Read-only across usage, audit, finance, and request logs. Cannot spend or change anything.

MemberWhat it is for · Spends from credit and views their own usage.

ViewerWhat it is for · Views their own usage only.

Hovering any role in the assign or invite dropdowns shows this summary inline.

Can they…	Owner	Admin	Billing	Developer	Analyst	Member	Viewer
Invite / remove members, assign roles	Yes	Yes	No	No	No	No	No
Create / archive workspaces	Yes	Yes	No	No	No	No	No
Create, rotate and revoke API keys	Yes	Yes	No	Yes	No	No	No
Manage seller offers and credentials	Yes	Yes	No	Yes	No	No	No
Spend on inference	Yes	Yes	No	Yes	No	Partialcredit only	No
Manage billing (cards, invoices)	Yes	No	Yes	No	No	No	No
Register and manage wallets	Yes	Yes	Yes	No	No	No	No
Set budgets	Yes	Yes	Yes	No	No	No	No
Withdraw payouts	Yes	No	Yes	No	No	No	No
Read the payout ledger	Yes	Yes	Yes	No	Yes	No	No
Read the workspace spend rollup	Yes	Yes	Yes	No	Yes	No	No
Read the audit log	Yes	Yes	Yes	No	Yes	No	No
Read request logs	Yes	Yes	No	Yes	Yes	No	No
Turn on request-body capture	Yes	Yes	No	No	No	No	No
Manage outbound webhooks	Yes	Yes	No	No	No	No	No
Read own usage	Yes	Yes	Yes	Yes	Yes	Yes	Yes

Read down a column for what a role gets, across a row for who holds a power. Two rows catch people out: an Admin runs the org but cannot touch billing or withdraw payouts, and an Analyst can reconcile payouts without being able to move one.

What each role can and cannot do

Owner

Everything. An owner can manage members and roles, workspaces, keys, offers, wallets, billing, budgets, and payouts (including withdrawals), and can read all usage, finance, audit, and request-log data. An owner is the only role that can change or remove another owner, or grant the owner role.

Admin

Can: manage members and roles; create and archive workspaces; manage API keys; manage offers and rotate seller credentials; manage wallets and budgets; configure payouts; spend; and read all usage, finance, audit, and request logs (including turning request-body capture on).
Cannot: manage billing, or withdraw payouts.

Billing admin

Can: manage billing; manage wallets; manage budgets; configure payouts and withdraw them; and read usage, finance, audit, and payout data.
Cannot: manage API keys, members, workspaces, or offers, and cannot spend.

Developer

Can: spend from credit and on-chain; create and manage API keys; manage offers and rotate seller credentials; and read request logs and their own usage.
Cannot: see the organization's bill or org-wide finance, and cannot turn on request-body capture.

Analyst

Can: read usage, audit logs, finance, request logs, and payout position.
Cannot: spend, move money, or change any setting. It is strictly read-only.

Member

Can: spend from credit and view their own usage.
Cannot: manage anything, and cannot see org-wide finance.

Viewer

Can: view their own usage.
Cannot: spend or change anything.

How roles are assigned

You can only assign roles at or below your own. You cannot grant a role that carries a permission you do not hold yourself. In practice, only an owner can create another owner.
Only an owner can change or remove another owner.
The last owner is protected. An organization must always have at least one owner, so the last owner cannot be removed or demoted.

Change a member's role any time from Settings, then Members. See Members and invitations.

Workspace roles

The table above is the organization role. A member can also hold a narrower workspace role (developer, analyst, member, viewer) on an individual workspace. Their effective permissions are the union of the two, de-duplicated — a workspace role adds, it never subtracts.

One deliberate asymmetry: a workspace analyst does not get the audit log, even though an org analyst does. The audit log is org-scoped, so no workspace-level role can grant it.

Previous← Overview NextMembers and roles →