Members & Roles

LLMx Prompt Studio uses a role-based access control system to manage what each team member can do within an organization. This guide explains the role hierarchy, permissions, and how to manage your team.

Role Hierarchy

Every organization member is assigned exactly one role. Roles are hierarchical, meaning higher roles include all permissions of lower roles.

Owner
  ↓
Admin
  ↓
Editor
  ↓
Viewer

Role Descriptions

Permission Matrix

The following table shows exactly what each role can do:

Viewing Members

To see who belongs to your organization:

1. Navigate to Settings (click the gear icon or go to /{org-slug}/settings)
2. Select the Members tab
3. View the member list with names, emails, and roles

The member list shows:

• Profile picture (if available)
• Display name
• Email address
• Current role
• When they joined

Changing Member Roles

Only Owners can change member roles.

To Change a Role

1. Go to Settings → Members
2. Find the member you want to update
3. Click the role dropdown next to their name
4. Select the new role
5. The change takes effect immediately

Role Change Restrictions

• Cannot demote yourself: If you’re the only Owner, you cannot change your own role
• Cannot demote the last Owner: Every organization must have at least one Owner
• Admins cannot modify Owners: Only Owners can change another Owner’s role

Removing Members

Owners and Admins can remove members from the organization.

To Remove a Member

1. Go to Settings → Members
2. Find the member you want to remove
3. Click the remove button (trash icon) next to their name
4. Confirm the removal

Removal Restrictions

• Cannot remove yourself: Use “Leave Organization” instead
• Cannot remove the last Owner: Transfer ownership first
• Admins cannot remove Owners: Only another Owner can remove an Owner

The Last Owner Rule

Every organization must have at least one Owner. This prevents organizations from becoming orphaned (having no one with full control).

Protected scenarios:

• The last Owner cannot change their own role
• The last Owner cannot be removed
• The last Owner cannot leave the organization

How to handle this:

1. Promote another member to Owner first
2. Then demote yourself or leave

Ownership Transfer

To transfer ownership of an organization:

1. Promote the new owner: Change their role from Admin/Editor/Viewer to Owner
2. Demote yourself (optional): Change your role to Admin, Editor, or Viewer
3. Leave the organization (optional): Remove yourself from the member list

Important: Multiple Owners are allowed. Consider having at least two Owners for business continuity.

Default Role for New Members

When inviting new members, you select their role. The organization setting Default Member Role (configured in Settings) determines the pre-selected option in the invitation form.

Most organizations use Editor as the default, allowing new members to contribute immediately without requiring manual role upgrades.

For Developers

Permission Helper Functions

The frontend provides centralized permission checking:

import {
  canEditContent,
  canManageMembers,
  canEditOrgSettings,
  isOwnerRole
} from '@/permissions';
 
// Check if current user can edit
if (canEditContent(currentRole)) {
  showEditButton();
}
 
// Check if current user can manage team
if (canManageMembers(currentRole)) {
  showInviteButton();
}

Role Comparison

Roles have a numeric hierarchy for comparison:

const ROLE_LEVELS = {
  viewer: 1,
  editor: 2,
  admin: 3,
  owner: 4
};
 
function hasMinimumRole(userRole, requiredRole) {
  return ROLE_LEVELS[userRole] >= ROLE_LEVELS[requiredRole];
}

Backend Permission Checks

API endpoints validate permissions server-side:

# Check if user has admin+ permissions
def require_admin(org_id: str, user_id: str):
    role = await org_service.get_user_role(org_id, user_id)
    if role not in [OrgRole.OWNER, OrgRole.ADMIN]:
        raise HTTPException(403, "Admin access required")
 
# Check if user is owner
def require_owner(org_id: str, user_id: str):
    role = await org_service.get_user_role(org_id, user_id)
    if role != OrgRole.OWNER:
        raise HTTPException(403, "Owner access required")

Role Model

class OrgRole(str, Enum):
    OWNER = "owner"
    ADMIN = "admin"
    EDITOR = "editor"
    VIEWER = "viewer"
 
# Permission helpers
def can_manage_members(role: OrgRole) -> bool:
    return role in [OrgRole.OWNER, OrgRole.ADMIN]
 
def can_edit(role: OrgRole) -> bool:
    return role in [OrgRole.OWNER, OrgRole.ADMIN, OrgRole.EDITOR]
 
def can_view(role: OrgRole) -> bool:
    return role in [OrgRole.OWNER, OrgRole.ADMIN, OrgRole.EDITOR, OrgRole.VIEWER]
 
def is_owner(role: OrgRole) -> bool:
    return role == OrgRole.OWNER