Roles and access
Everyone in a workspace has a role that decides what they can do. There are four, from read-only up to full control.
You set someone's role when you add them to a workspace, and you can change it later.
| Role | What they can do |
|---|---|
| Viewer | Read-only. Can look at environments, configuration, change sets, work items, pipelines, and runs, but can't change anything. |
| Editor | Everything a Viewer can, plus the day-to-day work: check environments for differences, create change sets, review them (approve or deny), undo one, start and retry runs, manage work items and board columns, and stop tracking a configuration item. |
| Admin | Everything an Editor can, plus setting up the workspace: manage environments and their credentials, mark which environments are production, build pipelines, decide who approves and how many are needed, manage members and access keys, and turn workspace settings like AI access on or off. |
| Owner | The person who created the workspace. They can do everything an Admin can — the two are the same powers — and their role can't be changed or removed, so there is always a record of who started it. |
Who can make a workspace
Anyone in your organization. The person who creates one administers it: they can add people, set it up, and — because administering a workspace includes ending it — clear its configuration or delete it. Nobody has to hand workspaces out.
Organization admins
A workspace belongs to the organization, not to a person. An admin of your organization can open every workspace in it, including ones nobody added them to, and administer any of them — up to and including deleting one. Moving a workspace to a different organization is theirs alone, since it hands it to another account. To be named as an approver, or to connect an AI assistant, an organization admin needs to be added to the workspace like anyone else.
AI assistants get a lower ceiling
When someone connects an AI assistant, it acts as them, with their role. It also stops at what an Editor can do, even when that person is an Admin or the Owner. So an assistant can look at configuration and put change sets together, and it can't manage members, environments, approval rules, or access keys.
On top of that, a workspace can let an assistant read without letting it put change sets together or edit work items, which is how it starts out. Changing a connected Aprimo instance is set for each instance. See What an AI agent can do.