What is the purpose of this role?
Who can assign this role?
When this role is first assigned?
How many instances of these roles?
Who can remove assignment of this role?
What permissions does this role have?
What is the purpose of this role?
Who can assign this role?
When this role is first assigned?
How many instances of these roles?
Who can remove assignment of this role?
What is the purpose of this role?
Who can assign this role?
When this role is first assigned?
How many instances of these roles?
Who can remove assignment of this role?
It’s essential to understand that owners are not roles, but entitlements.
Organization owners carry the organization administrator role, and may be joined in their organization administration duties by any number of other users carrying the organization administrator role. However, the organization owner also has the administrative privilege to delete the organization.
The entitlement of “organization owner” is automatically bestowed to the creator of a organization. The individual user who created a given organization initially is therefore granted certain administrative privileges beyond that of other organization administrators. Specifically, organization owners retain the sole permission to delete the organization.
For more information, see Organization.
What is the purpose of this role?
Who can assign this role?
When this role is first assigned?
How many instances of these roles?
Who can remove assignment of this role?
It’s essential to understand that owners are not roles, but entitlements.
Workspace owners carry the organization administrator role, and may be joined in their workspace administration duties by any number of other users carrying the workspace administrator role. However, the workspace owner also has the administrative privilege to delete the workspace.
The entitlement of “workspace owner” is automatically bestowed to the creator of a workspace. The individual user who created a given workspace initially is therefore granted certain administrative privileges beyond that of other workspace administrators. Specifically, workspace owners retain the sole permission to delete the workspace.
What is the purpose of this role?
Who can assign and unassign this role?
When is this role first assigned?
How many instances of these roles? Min: 1, Max: many
What is the purpose of this role?
Who can assign and unassign this role?
When is this role first assigned?
How many instances of these roles?
It’s essential to understand that owners are not roles, but entitlements.
Team owners carry the team administrator role, and may be joined in their team administration duties by any number of other users carrying the team administrator role. However, the team owner also has the administrative privilege to delete the team.
The entitlement of “team owner” is automatically bestowed to the creator of a team. The individual user who created a given team initially is therefore granted certain administrative privileges beyond that of other team administrators. Specifically, team owners retain the sole permission to delete the team.
For more information, see Teams.
Organization: Constellation Cloud
Scope: All tenants (Orbital Labs, Stellar Dynamics, and others)
Dr. Aiko Sato holds the Provider Admin role at Constellation Cloud, the MSP that manages Orbital Labs as a tenant. Provider Admins can create, view, edit and delete every resource across all tenant organizations. Dr. Sato has seen every misconfigured RBAC policy known to humankind, which is why she documents each one.
Organization: Orbital Labs
Scope: All resources within Orbital Labs
Maya Chen holds the Org Admin role for Orbital Labs. She manages user accounts, team membership, workspace creation, and role assignments within Orbital Labs. She also serves as Team Admin for the Development team — an Org Admin may administer any team in their organization.
Organization: Orbital Labs
Team: Infrastructure
Scope: Infrastructure team members and their workspace access
Zara Osei holds the Team Admin role for Orbital Labs’ Infrastructure team. She manages keychain assignments for Five and controls which environments the Infrastructure team can access. Access requests go through Zara’s 48-hour SLA — no exceptions, no matter how urgent Five thinks the situation is.
