Roles

Understand account roles and the capabilities each role grants.

A role is a named set of capabilities that controls what a person can do in an account. Open Control Center → Admin → Roles to see what each role grants. Assign the least-privileged role that supports each person's responsibilities.

Qore organizes access in three levels. Your organization's Qore deployment is its tenant. A tenant holds one or more accounts, and each account holds projects. For the full model, see Accounts, Projects, Spaces.

Roles are held per account membership. A person can hold several roles in one account, and their capabilities add up. The same person can be an Account Admin in one account and a Viewer in another, because a role held in one account does not carry into another. A role applies across every project in its account. The exception is Organisation Admin's three tenant-level capabilities, which reach every account in the tenant.

Your organization's policies manage roles at the tenant level. Contact your Organisation Admin to request a role change.

Each role's capabilities, as shown in Admin → Roles.

Choose a role

Qore has eight standard roles. Start with the role's primary responsibility.

Role	Primary responsibility
Viewer	Use published apps, agents, knowledge bases, and flows in a project without building anything.
Billing Manager	Viewer, plus review credit usage and set credit limits.
Approver	Viewer, plus review and approve the publishing of agents, apps, knowledge, and knowledge graphs.
Developer	Build, publish, and version apps, agents, knowledge bases, flows, and design systems in projects.
Governance Manager	Oversee knowledge, observability, evaluations, govern graphs, and resource permissions for the account.
Auditor	Inspect traces, analytics, audit logs, reports, credit usage, and controls, without changing them.
Account Admin	Administer one account: its members, teams, API keys, AI Gateway, cost controls, and governance.
Organisation Admin	Account Admin, plus three tenant-level capabilities that reach every account: create accounts, and manage the organization's brand and roles.

Roles created in your organization appear under Custom Roles in Admin → Roles. They are not described here.

Roles that are easy to confuse

Use this comparison when two roles appear similar. Choose the narrowest role that supports the work.

Organisation Admin or Account Admin?

Organisation Admin adds three tenant-wide capabilities: create accounts, manage the organization brand, and manage organization roles. Choose Account Admin for one account. Use Organisation Admin for the whole tenant.

Governance Manager or Auditor?

Governance Manager can change governance resources. Auditor only inspects them and can view credit usage. Choose Auditor for independent review.

Developer or Approver?

Developer builds and publishes. Approver approves publishing but does not build. Keep both roles separate when approval needs a second pair of eyes.

Governance Manager or Account Admin?

Account Admin adds user, team, API key, AI Gateway, credit-limit, and agent-control administration. Choose Governance Manager for governance work only.

Billing Manager or Auditor?

Both roles view credit usage. Billing Manager can also set credit limits. Choose Billing Manager for cost management.

Capabilities by role

Each section lists the roles that carry its capabilities. The sections match Admin → Roles. means the role has the capability. A dash means it does not.

Column abbreviations: Billing Mgr is Billing Manager. Dev is Developer. Gov Mgr is Governance Manager. Acct Admin is Account Admin. Org Admin is Organisation Admin.

Settings (Platform / Tenant)

Create an account, Manage organization brand, and Manage organization roles are tenant-level. They apply across every account in the tenant, and only Organisation Admin carries them. The other capabilities in this group apply within one account.

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Select an account
Select a project
Create a project	—	—	—		—	—
Create an account	—	—	—	—	—	—	—
Manage organization brand	—	—	—	—	—	—	—
Manage organization roles	—	—	—	—	—	—	—
View user	—	—	—
Create user	—	—	—	—	—	—
Manage user	—	—	—	—	—	—

Apps

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View apps
Build an app	—	—	—		—	—
Build an app headless	—	—	—		—	—
Import an app	—	—	—		—	—
Export an app	—	—	—		—	—
Publish an app	—	—	—		—	—
Share an app	—	—	—		—	—
Manage an app's custom domain	—	—	—		—	—
Connect an app to Git	—	—	—		—	—
Manage app versions	—	—	—		—	—
Attach an agent to an app	—	—	—		—	—

Agents

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View agents
Build an agent	—	—	—		—	—
Build an agent headless	—	—	—		—	—
Import an agent	—	—	—		—	—
Export an agent	—	—	—		—	—
Publish an agent	—	—	—		—	—
Trigger an agent
Share an agent	—	—	—		—	—
Manage agent versions	—	—	—		—	—
Attach a govern graph to an agent	—	—	—		—	—

Knowledge content

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View data sources
Build a data source	—	—	—			—
View knowledge
Build knowledge	—	—	—			—
Import knowledge	—	—	—			—
Export knowledge	—	—	—			—
Publish knowledge	—	—	—			—
Manage knowledge versions	—	—	—			—
Query knowledge
Share knowledge	—	—	—			—

Flows

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View flows
Build a flow	—	—	—		—	—
Publish a flow	—	—	—		—	—
Manage flow versions	—	—	—		—	—
Trigger a flow
Attach an agent to a flow	—	—	—		—	—

Store

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View the store

Integrations

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Use integrations
Manage integrations	—	—	—		—	—

Design system

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Manage design systems	—	—	—		—	—
View design systems

Observe

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View traces	—
View analytics	—	—	—	—
View audit logs	—	—	—	—
Manage exports	—	—	—	—		—
Run exports	—	—	—	—
View reports	—	—	—	—

Credits

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View credit usage	—		—	—	—
Set credit limits	—		—	—	—	—

Evals

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Build evals	—	—	—			—
View online evals	—	—

Govern

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View agent controls	—	—	—	—
Stop agents	—	—	—	—	—	—
Resume agents	—	—	—	—	—	—
Manage govern graphs	—	—	—	—		—
View govern graphs	—	—		—
Manage agent tool permissions	—	—	—	—		—

AI Gateway

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Use the AI Gateway	—	—	—			—
Configure the AI Gateway	—	—	—	—	—	—

Document AI

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Trigger the Document AI Agent	—	—	—		—	—

Users and teams

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
Remove a user	—	—	—	—	—	—
View teams	—	—	—	—		—
Manage teams	—	—	—	—	—	—
Manage API keys	—	—	—	—	—	—

Publish review

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View publish reviews	—	—
Approve agent publishing	—	—		—	—	—
Approve app publishing	—	—		—	—	—
Approve knowledge graph publishing	—	—		—	—	—
Approve knowledge publishing	—	—		—	—	—

Resource permissions

Capability	Viewer	Billing Mgr	Approver	Dev	Gov Mgr	Auditor	Acct Admin	Org Admin
View resource permissions	—	—	—	—
Manage resource permissions	—	—	—			—

FAQs

Can a person hold more than one role?

Yes. A person can hold several roles in one account, and their capabilities add up. Grant the combination that covers their work, rather than a broader role.

Do my roles apply in every account?

No. Roles are held per account membership, so a role in one account does not carry into another. Organisation Admin's three tenant-level capabilities are the exception: they reach every account in the tenant.

Which role should I give someone who only uses published apps and agents?

Viewer. It can view and trigger agents and flows, view apps, query knowledge, and use integrations, but it cannot build or publish anything.

Who can approve publishing?

Approver, Account Admin, and Organisation Admin. A Developer can publish and see publish reviews but cannot approve them.

Who can stop or resume a running agent?

Only Account Admin and Organisation Admin. Governance Manager and Auditor can view agent controls but cannot stop or resume agents.

Who can create API keys?

Only Account Admin and Organisation Admin carry Manage API keys.

Who can add, change, or remove users?

Only Account Admin and Organisation Admin can create, manage, and remove users. Developer, Governance Manager, and Auditor can view users but not change them.

Can I change what a standard role grants?

Your organization's policies manage roles, and only Organisation Admin carries Manage organization roles. To request a different set of capabilities, contact your Organisation Admin. Roles your organization creates appear under Custom Roles.

How do I give someone a role?

Assign roles when you create or edit a user, or when you add members to a team.

---

Maintained by Abhishek Paul AI-assisted, human-approved