Roles and permissions

Four roles, highest to lowest: owner, admin, member, guest.

:::note editor is gone Anyone still holding the old editor role is read as a member. :::

What each can do

	Owner	Admin	Member	Guest
Read everything in the organization	●	●	●	●
Run tests assigned to them	●	●	●	●
Comment, report bugs	●	●	●	●
Create and edit content	●	●	●
Delete content	●	●
Administration (members, invites, tokens, integrations, policies, custom fields)	●	●
Billing and subscription	●

"Members cannot delete", and how it is enforced

This is a rule about content, and it is enforced twice: the server refuses every DELETE from a member or guest, and the browser mirrors the same rule so the request is refused before it is sent, with a sentence rather than a 403 in the console.

Both copies have to agree. A rule in one and not the other is either a request the browser blocks that the server would have allowed, or the reverse.

The exemptions

A small allow-list covers deletions that destroy nothing:

• Clearing an unstable flag. A member who could raise the flag can lower it. Without this, a member could mark a test flaky and then be unable to unmark it, and because re-flagging an already-flagged test is treated as an edit, the visible symptom was the flag showing the date of the first mark forever.
• Your own AI connector tokens. They are your credentials, not organization content.

Guests

A guest — sometimes shown as a viewer — reads, comments, reports bugs, and runs what is assigned to them. Guests are counted separately from seats and are invited under a weekly allowance that grows with your seat count. See Plans and billing.

Changing somebody's role

Administration → Members. Owners and admins can change roles. There is always at least one owner; the last one cannot be demoted.

What is not role-gated

Watching things. Asking to be told about somebody else's activity is not a change, so anybody can watch a bug hunt, a session, a folder or an automated test regardless of role.