Console · People
Roles and Permissions
Last updated 4 November 2026
Tick and cross tables of what each of the five roles can do.
Every person in a Console account holds one role, and that role decides what they can do everywhere: in the Console, in the admin of each instance, in the CLI, and in CloudShell and the AI tools. There are five roles. Each one includes everything the roles below it can do, so the tables on this page read from left to right with more ticks as the role grows.
| Role | In short |
|---|---|
| Viewer | Dashboard, the instances list, and view staging and production. |
| Editor | Everything in Viewer, plus create, edit and delete staging and edit production. |
| Developer | Everything in Editor, plus developer tools: the CLI, instance logs, deploys and maintenance mode. |
| Admin | Everything in Developer, plus create and delete production, People, Account and billing. |
| Owner | Everything in Admin, plus remove people, transfer ownership and delete the account. Each account has one Owner. |
Roles are set on the People page by an Admin or the Owner. A role can also be overridden for one instance, so a person can be an Editor on the account and a Developer on a single instance. The higher of the two never applies to the Owner, whose role is the same everywhere.
In the tables, ✓ means the role can do it and ✗ means it cannot.
Instances
| Permission | Viewer | Editor | Developer | Admin | Owner |
|---|---|---|---|---|---|
| See the Dashboard | ✓ | ✓ | ✓ | ✓ | ✓ |
| See the instances list | ✓ | ✓ | ✓ | ✓ | ✓ |
| Open a staging instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Open a production instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Sign in to an instance admin | ✓ | ✓ | ✓ | ✓ | ✓ |
| See instance usage metrics | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create a staging instance | ✗ | ✓ | ✓ | ✓ | ✓ |
| Edit a staging instance | ✗ | ✓ | ✓ | ✓ | ✓ |
| Delete a staging instance | ✗ | ✓ | ✓ | ✓ | ✓ |
| Edit a production instance | ✗ | ✓ | ✓ | ✓ | ✓ |
| Take your own instance access token | ✗ | ✓ | ✓ | ✓ | ✓ |
| Create a production instance | ✗ | ✗ | ✗ | ✓ | ✓ |
| Delete a production instance | ✗ | ✗ | ✗ | ✓ | ✓ |
| Issue instance access tokens for scripts and services | ✗ | ✗ | ✗ | ✓ | ✓ |
Developer tools
| Permission | Viewer | Editor | Developer | Admin | Owner |
|---|---|---|---|---|---|
| Use the Insites CLI | ✗ | ✗ | ✓ | ✓ | ✓ |
| View instance logs | ✗ | ✗ | ✓ | ✓ | ✓ |
| Put an instance into maintenance mode | ✗ | ✗ | ✓ | ✓ | ✓ |
| Update, roll back or reinstall a module on an instance | ✗ | ✗ | ✓ | ✓ | ✓ |
| Rotate an instance SSO key | ✗ | ✗ | ✗ | ✓ | ✓ |
CloudShell and AI tools
| Permission | Viewer | Editor | Developer | Admin | Owner |
|---|---|---|---|---|---|
| Read files, logs, deployments and environment variables | ✓ | ✓ | ✓ | ✓ | ✓ |
| Set environment variables and edit records | ✗ | ✓ | ✓ | ✓ | ✓ |
| Push to a branch in a connected repository | ✗ | ✓ | ✓ | ✓ | ✓ |
| Deploy, sync, upload assets and roll back | ✗ | ✗ | ✓ | ✓ | ✓ |
| Connect or disconnect a repository | ✗ | ✗ | ✓ | ✓ | ✓ |
| Create a staging instance from CloudShell | ✗ | ✗ | ✓ | ✓ | ✓ |
| Create a production instance from CloudShell | ✗ | ✗ | ✗ | ✓ | ✓ |
| Manage or delete an instance from CloudShell | ✗ | ✗ | ✗ | ✓ | ✓ |
People
| Permission | Viewer | Editor | Developer | Admin | Owner |
|---|---|---|---|---|---|
| See the People page | ✗ | ✗ | ✗ | ✓ | ✓ |
| Invite people | ✗ | ✗ | ✗ | ✓ | ✓ |
| Change a role | ✗ | ✗ | ✗ | ✓ | ✓ |
| Remove a person from the account | ✗ | ✗ | ✗ | ✗ | ✓ |
Account and billing
| Permission | Viewer | Editor | Developer | Admin | Owner |
|---|---|---|---|---|---|
| Open the Account page | ✓ | ✓ | ✓ | ✓ | ✓ |
| Edit the Account page | ✗ | ✗ | ✗ | ✓ | ✓ |
| View billing: plan, invoices and payment method | ✗ | ✗ | ✗ | ✓ | ✓ |
| Manage billing: change the plan, payment method or subscription | ✗ | ✗ | ✗ | ✓ | ✓ |
| Transfer ownership of the account | ✗ | ✗ | ✗ | ✗ | ✓ |
| Delete the account | ✗ | ✗ | ✗ | ✗ | ✓ |
IIA administrator
One more level exists outside the five roles: the IIA administrator. It is given only by an invitation sent from an instance's admin, to someone who is not a member of the Console account. An IIA administrator can sign in to the admin of that one instance and nothing else. They do not appear on the People page, cannot open the Console, and get no tick in any table above. What they can do inside the instance is set by the instance's own permissions, not by the Console.