Orkesta uses role-based access control (RBAC) assigned at the workspace level with optional per-project overrides. Every member has exactly one workspace role; that role applies across all projects by default unless you explicitly override it on a specific project.Documentation Index
Fetch the complete documentation index at: https://docs.orkesta.com.tr/llms.txt
Use this file to discover all available pages before exploring further.
Built-in roles
Three built-in roles cover the most common access patterns.Admin
Full access to workspace settings, billing, member management, API credentials, and all projects. Assign this role only to members who need to manage the workspace itself.
Member
Can create and operate within projects they belong to. Cannot access workspace-level settings such as billing or SSO configuration. The right default for most team members.
Viewer
Read-only access to the projects they belong to. Cannot create, edit, or delete any data. Use this role for stakeholders who need visibility without write access.
Custom roles
Custom roles let you define precise permission sets beyond what the built-in roles offer. You choose exactly which actions a custom role can perform, then assign it to members just like a built-in role.Custom roles are available on Business and Enterprise plans. Each workspace can have up to 20 custom roles.
Create a custom role
Name the role
Enter a clear, descriptive name that reflects the role’s intended function (for example,
Data Analyst or Billing Contact).Toggle permissions
Work through the permission categories — workspace, projects, payment data, reports, and API — and enable exactly what this role needs.
Common custom role patterns
| Custom role | Typical permissions |
|---|---|
| Data analyst | Read access to reports and transaction history; no write access to payments or settings. |
| Integration manager | Read-write access to API credentials and webhook configuration; no access to billing or members. |
| Billing contact | Read-write access to billing and invoices only; no access to projects or payment operations. |
Per-project overrides
Project-level role overrides let you grant a member more (or less) access on a specific project than their workspace role provides. The project role takes precedence over the workspace role within that project. For example, a workspace Viewer can be given the Member role on one project so they can contribute there while retaining read-only access everywhere else.Assign a per-project override
To remove a project-level override and return the member to their workspace role, open the same role dropdown and select Use workspace role.