DOCS

Roles and permissions reference

Complete matrix of what each workspace role can do.

Role overview

Every workspace member holds a role. The system seeds these built-in roles per workspace:

Role	Summary
Owner	Full access including billing, ownership transfer, and workspace deletion. One per workspace.
Admin	Full access, including billing. Can manage all team members. Cannot transfer ownership or delete the workspace.
Member (editor)	Create and manage all technical resources. Read-only view of billing and settings; cannot manage the team or change plans.
Viewer	Read-only access across the workspace.

Owner and Admin bypass fine-grained permission checks and have full access. Members hold the editor system role; viewer and editor are seeded as built-in system roles alongside admin. For access profiles beyond these, use custom roles. See Custom roles below.

Permissions matrix

Monitors

Action	Owner	Admin	Member
View monitors	Yes	Yes	Yes
Create monitor	Yes	Yes	Yes
Edit monitor	Yes	Yes	Yes
Pause / resume monitor	Yes	Yes	Yes
Delete monitor	Yes	Yes	Yes

Heartbeats

Action	Owner	Admin	Member
View heartbeats	Yes	Yes	Yes
Create heartbeat	Yes	Yes	Yes
Edit heartbeat	Yes	Yes	Yes
Delete heartbeat	Yes	Yes	Yes

Incidents

Action	Owner	Admin	Member
View incidents	Yes	Yes	Yes
Acknowledge incident	Yes	Yes	Yes
Resolve incident	Yes	Yes	Yes
Add note to incident	Yes	Yes	Yes

Notification channels

Action	Owner	Admin	Member
View channels	Yes	Yes	Yes
Create channel	Yes	Yes	Yes
Edit channel	Yes	Yes	Yes
Delete channel	Yes	Yes	Yes
Send test notification	Yes	Yes	Yes

Alert routing rules

Action	Owner	Admin	Member
View rules	Yes	Yes	Yes
Create / edit / delete rules	Yes	Yes	Yes

On-call schedules

Action	Owner	Admin	Member
View schedules	Yes	Yes	Yes
Create / edit / delete schedules	Yes	Yes	Yes
Create schedule override	Yes	Yes	Yes

Status pages

Action	Owner	Admin	Member
View status pages	Yes	Yes	Yes
Create / edit / delete status pages	Yes	Yes	Yes
Manage subscribers	Yes	Yes	Yes

Team management

Action	Owner	Admin	Member
View members	Yes	Yes	Yes
Invite member	Yes	Yes	No
Change member role	Yes	Yes	No
Remove member	Yes	Yes	No

Billing

Action	Owner	Admin	Member
View billing / invoices	Yes	Yes	Yes
Change plan / cancel	Yes	Yes	No
Update payment method	Yes	Yes	No

API tokens

Action	Owner	Admin	Member
Create own tokens	Yes	Yes	Yes
Revoke own tokens	Yes	Yes	Yes
View team token metadata	Yes	Yes	No
Revoke any token	Yes	Yes	No

Workspace settings

Action	Owner	Admin	Member
View settings	Yes	Yes	Yes
Edit workspace settings	Yes	Yes	No
Configure SSO	Yes	Yes	No
Transfer ownership	Yes	No	No
Delete workspace	Yes	No	No

Custom roles

The built-in roles cover most teams, but you can define custom roles for finer-grained access: an incident-only responder, or any other scoped profile your organization needs.

Manage them under Settings > Roles. Custom roles are stored with is_system = false, which distinguishes them from the built-in system roles (admin, editor, viewer) that are seeded per workspace with is_system = true.
Assign a custom role when you invite a teammate: it appears in the role dropdown under a Custom roles group, alongside the system roles.
A built-in Viewer role already provides read-only access, and editor is the system role behind Member. Custom roles let you go beyond these, for example a responder-style profile scoped to incidents only.

Changing a member's role

Only Owner and Admin can change roles. Once a member has joined, their system role can be switched between Admin and Member. You cannot assign or remove the Owner role through this path; use Settings > Team > Transfer ownership.