Roles & Permissions
Unseenr uses a three-tier role system: Owner, Admin, and Member. Roles are enforced server-side via the orgRole in the API middleware context.
Role Hierarchy
OWNER > ADMIN > MEMBER
Owner
- Full control over the organization
- Manages billing (checkout, plan changes, Stripe Customer Portal)
- Can toggle overage on/off
- Can delete the organization
- Can promote/demote members
- Only one owner per organization
Admin
- Can create and delete projects
- Can manage project settings
- Can invite and remove members (except the owner)
- Can manage alert configurations
- Cannot access billing or delete the organization
Member
- Can view all projects they have access to
- Can view and comment on issues
- Can create and manage their own alert configurations
- Cannot change project settings or manage other members
Permission Matrix
| Action | Owner | Admin | Member |
|---|---|---|---|
| View projects | Yes | Yes | Yes |
| Create projects | Yes | Yes | No |
| Delete projects | Yes | Yes | No |
| Modify project settings | Yes | Yes | No |
| View issues | Yes | Yes | Yes |
| Resolve/ignore issues | Yes | Yes | Yes |
| Comment on issues | Yes | Yes | Yes |
| Manage monitors | Yes | Yes | No |
| Create alerts | Yes | Yes | Yes |
| Manage team members | Yes | Yes | No |
| Access billing | Yes | No | No |
| Delete organization | Yes | No | No |
| Manage client keys | Yes | Yes | No |
| View audit log | Yes | Yes | No |
Security Notes
- All permission checks are performed server-side. Client-side checks are for UI convenience only.
- Plan and feature checks are always read from the database, never from session cache.
- Every database query is scoped by
organizationId(ownership scoping).
Also available in:Deutsch