Organization roles and project protection

ModelRiver has four organization membership roles. These roles are separate from users.role, which grants access to the system administration panel.

Capability	Owner	Admin	Editor	Viewer
Read organization projects	Yes	Yes	Yes	Yes
Create, update, archive, or delete projects	Yes	Yes	No	No
Change project settings or protection	Yes	Yes	No	No
Edit project resources	All projects	All projects	Unprotected only	No
Test workflows in Playground	All projects	All projects	All projects	No
Retry webhook deliveries or delete sessions	All projects	All projects	Unprotected only	No
Modify a protected project	Yes	Yes	No	No
Manage members, invitations, and organization settings	Yes	No	No	No
Manage billing and plans	Yes	No	No	No

There are no project membership assignments. An Editor can edit resources in every unprotected project in the organization.

Project protection

projects.protected_at is nullable. A non-null timestamp means the project is protected. Only an organization Owner or Admin can set or clear it.

For Editors, protection blocks these explicitly enumerated console and control-plane mutations:

API keys and project provider credentials
workflows and structured outputs
webhook configuration and delivery retries
session deletion

Editors can test workflows and reconnect to existing Playground runs even when a project is protected. Viewers cannot run Playground tests in any project. Playground access does not grant Editors permission to save workflow or project changes.

Protection does not stop normal runtime execution authenticated by project API keys or internal workers. Runtime session updates, request logging, usage and budget accounting, callbacks, and other operational state continue normally. API-key-authenticated webhook configuration endpoints are control-plane APIs and reject mutations while a project is protected.

Role management

Only the Owner can invite, resend or cancel invitations, remove members, or change roles. Assignable roles are Admin, Editor, and Viewer. The Owner role cannot be assigned, changed, or removed through the member API.

Team membership management is available on paid plans. On the free plan, an organization remains single-member. In the Console, open the organization menu and select Team members to invite a member or change an existing member's role. New invitations default to Editor.

Existing member rows are migrated to editor. Application authorization temporarily recognizes the legacy value during a rolling deployment, but new invitations and role changes cannot create it.

Protection management

An Owner or Admin can open a project, select Settings, and use the Project protection section to protect or unprotect it. Editors and Viewers cannot change protection or other project settings.

Enforcement

Server-side checks are authoritative. The project response includes a permissions object for UI presentation, but clients must not treat hidden controls as authorization. Global provider and model catalog mutations require the separate system-admin role (users.role == :admin).