> ## Documentation Index > Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # User Roles & Permissions > Learn about Portkey's comprehensive role-based access control system across Organizations and Workspaces. Portkey implements a comprehensive role-based access control (RBAC) system that operates across two main hierarchical levels: **Organizations** and **Workspaces**. This dual-layer approach ensures precise control over who can access what resources, enhancing security while enabling effective team collaboration. ## Organization Level Organizations represent the highest level of structure within Portkey. At this level, there are three distinct roles with varying levels of administrative control: > [card] Owner > > The highest authority with complete control of the organization > [card] Admin > > Extensive administrative privileges across the organization > [card] Member > > Base-level organization access, typically assigned to workspace roles ### Organization Role Permissions | Capability | Owner | Admin | Member (without workspace) | | - | :-: | :-: | :-: | | Billing Management | | | | | Manage Organization Settings | | | | | Create/Delete Workspaces | | | | | Manage Admin API Keys | | | | | Edit User Roles | | | | | Invite Organization Users | | | | | Configure Access Permissions | | | | | Access to All Workspaces | | | | > [!NOTE] > > **Important**: Organization Owners and Admins automatically receive Admin-level access to all workspaces within the organization. All users must first be added as Organization Members before they can be invited to any workspace. ## Workspace Level Workspaces are sub-organizational units that enable better team and project management. Each workspace maintains its own access control structure with three distinct roles: > [card] Admin > > Complete control over workspace configuration and team management > [card] Manager > > Administrative capabilities for team and resource management > [card] Member > > Limited write access (own API keys, configs, prompts) with read-only access to other resources ### Workspace Role Permissions | Capability | Admin | Manager | Member | | - | :-: | :-: | :-: | | Invite Organization Members to Workspace | | | | | Assign Workspace Roles (including Admin) | | | | | Update Workspace Settings | | | | | Create/Update/Delete Service API Keys | | | | | Create/Update/Delete User API Keys (own keys only for Members) | | | | | Create/Update Prompts | | | | | Publish/Delete Prompts | | | | | Create/Update/Delete Configs | | | | | Create/Update/Delete Guardrails | | | | | Create/Update/Delete Policies | | | | | Create/Update/Delete Providers | | | | | Create/Update/Delete Virtual Keys | | | | | View/List/Copy Virtual Keys | | | | | Create/Update/Delete MCP Servers | | | | | View/List MCP Servers | | | | | Create/Update/Delete Agent Servers | | | | | View/List Agent Servers | | | | | Create/Update Workspace Integrations | | | | | View Logs & Analytics | | | | | Export Logs & Analytics | | | | | View All Other Workspace Resources | | | | > [!NOTE] > > **Member Access**: Workspace Members can create, update, and delete their own **User API Keys**, **Configs**, and **Prompts** (except publish/delete). For all other resources, Members have read-only access. > [!WARNING] > > **API Key Privilege Escalation Prevention**: A user cannot modify an API key that carries permissions exceeding their own role. This is a security measure to prevent privilege escalation. If a legacy API key needs updating, an admin should retire it and create a new one with appropriately scoped permissions. ## Access Permission Configuration Organization Owners and Admins can configure access permissions for various resources across workspaces. These settings determine what each role can access: > [!NOTE] > > By default Workspace Admins and Managers have the same permissions unless changed by Organization Owner or Admin. > [card] [Logs Access Permissions](https://docs.portkey.ai/docs/product/administration/configure-logs-access-permissions-in-workspace.md) > > Control which roles can view, filter, and export logs > [card] [Analytics Access Permissions](https://docs.portkey.ai/docs/product/administration/configure-analytics-access-permissions.md) > > Control which roles can view analytics dashboards > [card] [Providers Access Permissions](https://docs.portkey.ai/docs/product/model-catalog.md) > > Manage access to LLM providers for different roles > [card] [API Key Permissions](https://docs.portkey.ai/docs/product/administration/configure-api-key-access-permissions.md) > > Configure API key creation and management rights > [!NOTE] > > **Key Workflow**: Users must first be added as organization members before they can be invited to any workspace. Workspace admins and managers can then invite organization members to their workspace and assign appropriate roles. ## Related Topics > [card] [Organizations](https://docs.portkey.ai/docs/product/enterprise-offering/org-management/organizations.md) > [card] [Workspaces](https://docs.portkey.ai/docs/api-reference/admin-api/control-plane/workspaces/create-workspace.md) > [card] [API Keys (AuthN and AuthZ)](https://docs.portkey.ai/docs/product/enterprise-offering/org-management/api-keys-authn-and-authz.md) > [card] [Access Control Management](https://docs.portkey.ai/docs/product/enterprise-offering/access-control-management.md) *** > [card] [Portkey is now PRISMA AIRS AI Gateway. See it in action.](https://www.paloaltonetworks.in/ai-security/ai-gateway?utm_source=portkey\&utm_medium=referral\&utm_campaign=prisma_airs\&utm_content=docs_nav#contact) > > Contact Us ## Related topics - [API Keys (AuthN and AuthZ)](https://docs.portkey.ai/docs/product/enterprise-offering/org-management/api-keys-authn-and-authz.md) - [Workspaces](https://docs.portkey.ai/docs/product/enterprise-offering/org-management/workspaces.md) - [API Key Rotation](https://docs.portkey.ai/docs/product/enterprise-offering/org-management/api-key-rotation.md) - [Access Control Management](https://docs.portkey.ai/docs/product/enterprise-offering/access-control-management.md) - [Error AB03: You do not have enough permissions](https://docs.portkey.ai/docs/help-center/you-do-not-have-enough-permissions.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.