Roles & Permissions
Overview
Syntropic uses two layers of roles:
- Organization roles: OWNER, ADMIN, MEMBER
- Workspace roles: ADMIN, CREATOR, EDITOR, VIEWER
Higher roles include the permissions of lower roles (inclusive hierarchy).
Default connection access
Organization owners can choose Organization Settings → Settings → Default connection access:
- Grant access manually (the initial default): admins grant connection access individually in User Management after adding members or connections.
- All workspace connections: adding a member automatically grants access to all connections present in that workspace. Creating or copying a connection grants every current workspace member access to that new connection, including pending invitees. Admins can remove or restore these grants in User Management.
The current organization default applies whenever a member or connection is added to any existing or new workspace, through either the app or MCP. This includes existing organization members joining another workspace. Inviting members before or after copying a connection produces the same access while automatic access is enabled.
Changing the default does not rewrite permissions on existing connections. Re-sending invitations, changing roles, editing connections, and adding other members or connections do not restore revoked grants. New connections use the default in effect when they are created or copied. Under the manual default, admins assign access in User Management.
Workspace roles still determine what members can do. The default does not add anyone to other workspaces or grant access to connection credentials. Admins continue to have access to every connection under either default.
Workspace roles
The workspace role controls what a user can do inside a specific workspace.
| Capability | Viewer | Editor | Creator | Admin |
|---|---|---|---|---|
| View connections list | ✓ | ✓ | ✓ | ✓ |
| View connection details (incl. credentials) | ✓ | |||
| Create/update/delete connections | ✓ | |||
| View tables, schemas, and data | ✓ | ✓ | ✓ | ✓ |
| View history of table edits | ✓ | ✓ | ✓ | ✓ |
| Edit table data (insert/update) | ✓ | ✓ | ✓ | |
| Create tables | ✓ | ✓ | ||
| Update table schemas | ✓ | ✓ | ||
| Webhooks – view logs | ✓ | ✓ | ✓ | ✓ |
| Webhooks – view and manage | ✓ | ✓ | ||
| Webhooks – generate tokens | ✓ | ✓ | ||
| Manage workspace users & roles | ✓ | |||
| Manage user-to-connection access | ✓ |
Organization roles
The organization role controls what a user can do across the organization.
| Capability | Member | Admin | Owner |
|---|---|---|---|
| Use workspaces if assigned | ✓ | ✓ | ✓ |
| View organization details | ✓ | ✓ | ✓ |
| View organization members | ✓ | ✓ | ✓ |
| Create/update/delete workspaces | ✓ | ✓ | |
| Invite members | ✓ | ✓ | |
| Remove members | ✓ | ✓ | |
| Change member roles | ✓ | ✓ | |
| Update organization settings | ✓ | ✓ | |
| Manage billing and subscriptions | ✓ |
Billing belongs to the organization. Only the organization Owner can start Checkout, open the Stripe Customer Portal, or read billing status. A workspace role never grants billing access.