> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://www.comet.com/docs/opik/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://www.comet.com/docs/opik/_mcp/server. # Roles and Permissions Opik uses a role-based access control (RBAC) system that allows you to define what users can do within workspaces. This guide explains how roles and permissions work, the default roles available, and how to create custom roles. ## Organization roles vs. workspace roles Opik has two levels of roles that work together: | Level | Purpose | Scope | Examples | | ---------------------- | -------------------------------------------- | ------------------- | ------------------------------- | | **Organization roles** | Control access to organization-wide features | Entire organization | Admin, Member, View-Only Member | | **Workspace roles** | Control what users can do within a workspace | Single workspace | Manage, Write, Annotator, Read | A user's effective access is determined by **both** their organization role and their workspace role: * Organization role sets the maximum level of access a user can have across all workspaces (e.g., View-Only Members are restricted to read-only access organization-wide). * Workspace role determines what they can do within each workspace they're a member of, up to the limit set by their organization role. ## Organization roles Every user in your organization has exactly one organization role: | Role | Description | | -------------------- | ---------------------------------------------------------------------------------------------------------------------- | | **Admin** | Full access to the [Admin Dashboard](/administration/admin-dashboard/overview) and all workspaces in the organization. | | **Member** | Can have full access to any workspace they are added to. No access to the Admin Dashboard. | | **View-Only Member** | Read-only access to workspaces they are added to. Cannot be granted write permissions in any workspace. | New users are assigned the **Member** role by default. Organization admins can change a user's role from the [Users](/administration/admin-dashboard/users) page in the Admin Dashboard. ## Workspace roles Workspace roles control what users can do within a specific workspace. Users can have different roles in different workspaces. ### Default roles These roles are available in all Opik organizations and serve as the basis for custom roles: | Role | Description | | ------------ | ---------------------------------------------------------------- | | **Manage** | Full admin access. Manage members, settings, and all resources. | | **Write** | Read-write access. Create projects, log traces, run experiments. | | **Annotate** | Annotation access. View data and add annotations/feedback. | | **Read** | Read-only access. View all data but cannot make changes. | ### Permissions by role The table below shows the default permissions for each role. Custom roles can combine these permissions differently. | Group | Permission | Manage | Write | Annotate | Read | | ------------------------ | ----------------------------------- | ------ | ----- | -------- | ---- | | Workspace administration | Manage users and roles | Yes | No | No | No | | Workspace administration | Invite users to workspace | Yes | Yes | No | No | | Workspace administration | Configure workspace preferences | Yes | No | No | No | | Workspace administration | Configure AI providers | Yes | Yes | No | No | | Experiment management | Manage project visibility | Yes | No | No | No | | Experiment management | Manage the model registry | Yes | No | No | No | | Opik observability | Create Opik projects | Yes | Yes | No | No | | Opik observability | Delete Opik projects | Yes | Yes | No | No | | Opik observability | View traces and logs | Yes | Yes | Yes | Yes | | Opik observability | View unanonymized data | Yes | Yes | Yes | Yes | | Opik observability | Log traces, spans, and threads | Yes | Yes | No | No | | Opik observability | Annotate traces, spans, and threads | Yes | Yes | Yes | No | | Opik observability | Delete traces, spans, and threads | Yes | Yes | No | No | | Opik observability | View dashboards | Yes | Yes | No | Yes | | Opik observability | Create dashboards | Yes | Yes | No | No | | Opik observability | Edit dashboards | Yes | Yes | No | No | | Opik observability | Delete dashboards | Yes | Yes | No | No | | Opik development | View prompts | Yes | Yes | No | Yes | | Opik development | Create prompts | Yes | Yes | No | No | | Opik development | Edit prompts | Yes | Yes | No | No | | Opik development | Delete prompts | Yes | Yes | No | No | | Opik development | Use the agent playground | Yes | Yes | No | Yes | | Opik development | Use the prompt playground | Yes | Yes | No | No | | Opik development | View optimization runs | Yes | Yes | No | Yes | | Opik development | Use the optimization studio | Yes | Yes | No | No | | Opik development | Delete optimization runs | Yes | Yes | No | No | | Opik evaluation | View datasets and test suites | Yes | Yes | No | Yes | | Opik evaluation | Create datasets and test suites | Yes | Yes | No | No | | Opik evaluation | Edit datasets and test suites | Yes | Yes | No | No | | Opik evaluation | Delete datasets and test suites | Yes | Yes | No | No | | Opik evaluation | View experiments | Yes | Yes | No | Yes | | Opik evaluation | Create experiments | Yes | Yes | No | No | | Opik evaluation | View annotation queues | Yes | Yes | Yes | Yes | | Opik evaluation | Create annotation queues | Yes | Yes | No | No | | Opik evaluation | Annotate items in queues | Yes | Yes | Yes | Yes | | Opik evaluation | Edit annotation queues | Yes | Yes | No | No | | Opik evaluation | Export annotation queue results | Yes | Yes | Yes | Yes | | Opik evaluation | Delete annotation queues | Yes | Yes | No | No | | Opik production | View online evaluation rules | Yes | Yes | No | Yes | | Opik production | Manage online evaluation rules | Yes | Yes | No | No | | Opik production | View alerts | Yes | Yes | No | Yes | | Opik production | Manage alerts | Yes | Yes | No | No | **View unanonymized data** only affects workspaces where anonymization is enabled. [Contact us](https://www.comet.com/site/about-us/contact-us/) to enable anonymization for your organization. ### Custom roles Custom roles are available on Enterprise plans. [Reach out](https://www.comet.com/site/about-us/contact-us/) to enable this feature. To create a custom role: 1. Go to **Admin Dashboard** > **Roles & Permissions**. 2. Click **Create Role** and configure permissions. 3. Inherit from an existing role as a starting point. ## Assigning roles Roles can be updated in different places depending on the role type: * **Organization roles** can be updated by organization admins in **Admin Dashboard** > **[Users](/administration/admin-dashboard/users)**. * **Workspace roles** can be updated in **Configuration** > **[Members](/administration/workspace-settings/workspace_members)** by any user with the Manage workspace role. ## Next steps * [Configure authentication](/administration/authentication/overview) with role mapping. * [Manage users](/administration/admin-dashboard/users) and assign roles. * [Create service accounts](/administration/admin-dashboard/service_accounts) with appropriate workspace access.