Access Roles

Every member holds exactly one role, and that role applies across the whole organization. When you need finer control, per-group scoping layers on top through Access Groups, so you can pair a broad role with a narrow visibility scope.

The five roles

TofuPilot ships with five roles that cover the full range from full administrative control down to operator-only kiosk access. The table below summarizes what each role can do.

Owner

You get one Owner per organization, and that account owns everything. Owners can do everything an Admin can, and on top of that they handle billing, SSO and SCIM configuration, ownership transfer, and organization deletion.

Admin

Admins manage members and structure, so they handle the day-to-day people work. They invite and remove members, change roles, create and delete access groups, and manage test data such as Procedures, Stations, Deployments, and Runs.

Admins cannot update organization settings, manage billing, or configure SSO and SCIM, because those actions are reserved for the Owner.

Developer

Developers create and update procedures, stations, deployments, Parts, Units, Batches, and other test data. They see every access group's data, so they can work across production lines without restriction.

Developers cannot manage members, access groups, billing, or SSO.

Viewer

Viewers are read-only, so they browse runs, units, parts, and analytics without being able to create or modify anything.

What a Viewer sees depends on their access group assignment:

• A Viewer with no access group assignments sees every access group's data.
• A Viewer with access group assignments sees only those access groups' stations and runs.

Operator

Operators land on /operator on sign-in and never see the dashboard. They see their own profile, the stations they belong to (always group-scoped), and basic org context. They do not see a member list, peer profiles, runs, procedures, API activity, or billing.

Test data is produced through the Station API key, not the operator's account. When an operator presses Run in the Operator UI, the run is auto-attributed as operated_by, because the dashboard forwards the operator's email to the CLI and the CLI stamps it on runs.create. CLI-only runs and kiosk-mode mounts with no logged-in user stay unattributed.

Roles vs access groups

Access Groups sit on an orthogonal layer to roles, so the two combine when you decide what someone sees.

• Owners, Admins, and Developers see every access group's data.
• Viewers see all data without access group assignments, and become group-scoped once you assign them.
• Operators are always group-scoped.

Changing a role

Admins and Owners can change a role at any time, and the change applies immediately. For the full walkthrough, see Managing members.