Roles and Permissions

Opik uses a role-based access control (RBAC) system that allows you to define what users can do within workspaces. This guide explains how roles and permissions work, the default roles available, and how to create custom roles.

Organization roles vs. workspace roles

Opik has two levels of roles that work together:

Level	Purpose	Scope	Examples
Organization roles	Control access to organization-wide features	Entire organization	Admin, Member, View-Only Member
Workspace roles	Control what users can do within a workspace	Single workspace	Manage, Write, Annotator, Read

A user's effective access is determined by both their organization role and their workspace role:

Organization role sets the maximum level of access a user can have across all workspaces (e.g., View-Only Members are restricted to read-only access organization-wide).
Workspace role determines what they can do within each workspace they're a member of, up to the limit set by their organization role.

Organization roles

Every user in your organization has exactly one organization role:

Role	Description
Admin	Full access to the Admin Dashboard and all workspaces in the organization.
Member	Can have full access to any workspace they are added to. No access to the Admin Dashboard.
View-Only Member	Read-only access to workspaces they are added to. Cannot be granted write permissions in any workspace.

New users are assigned the Member role by default. Organization admins can change a user's role from the Users page in the Admin Dashboard.

Workspace roles

Workspace roles control what users can do within a specific workspace. Users can have different roles in different workspaces.

Default roles

These roles are available in all Opik organizations and serve as the basis for custom roles:

Role	Description
Manage	Full admin access. Manage members, settings, and all resources.
Write	Read-write access. Create projects, log traces, run experiments.
Annotate	Annotation access. View data and add annotations/feedback.
Read	Read-only access. View all data but cannot make changes.

Permissions by role

The table below shows the default permissions for each role. Custom roles can combine these permissions differently.

Group	Permission	Manage	Write	Annotate	Read
Workspace administration	Manage users and roles	Yes	No	No	No
Workspace administration	Invite users to workspace	Yes	Yes	No	No
Workspace administration	Configure workspace preferences	Yes	No	No	No
Workspace administration	Configure AI providers	Yes	Yes	No	No
Experiment management	Manage project visibility	Yes	No	No	No
Experiment management	Manage the model registry	Yes	No	No	No
Opik observability	Create Opik projects	Yes	Yes	No	No
Opik observability	Delete Opik projects	Yes	Yes	No	No
Opik observability	View traces and logs	Yes	Yes	Yes	Yes
Opik observability	View unanonymized data	Yes	Yes	Yes	Yes
Opik observability	Log traces, spans, and threads	Yes	Yes	No	No
Opik observability	Annotate traces, spans, and threads	Yes	Yes	Yes	No
Opik observability	Delete traces, spans, and threads	Yes	Yes	No	No
Opik observability	View dashboards	Yes	Yes	No	Yes
Opik observability	Create dashboards	Yes	Yes	No	No
Opik observability	Edit dashboards	Yes	Yes	No	No
Opik observability	Delete dashboards	Yes	Yes	No	No
Opik development	View prompts	Yes	Yes	No	Yes
Opik development	Create prompts	Yes	Yes	No	No
Opik development	Edit prompts	Yes	Yes	No	No
Opik development	Delete prompts	Yes	Yes	No	No
Opik development	Use the agent playground	Yes	Yes	No	Yes
Opik development	Use the prompt playground	Yes	Yes	No	No
Opik development	View optimization runs	Yes	Yes	No	Yes
Opik development	Use the optimization studio	Yes	Yes	No	No
Opik development	Delete optimization runs	Yes	Yes	No	No
Opik evaluation	View datasets and test suites	Yes	Yes	No	Yes
Opik evaluation	Create datasets and test suites	Yes	Yes	No	No
Opik evaluation	Edit datasets and test suites	Yes	Yes	No	No
Opik evaluation	Delete datasets and test suites	Yes	Yes	No	No
Opik evaluation	View experiments	Yes	Yes	No	Yes
Opik evaluation	Create experiments	Yes	Yes	No	No
Opik evaluation	View annotation queues	Yes	Yes	Yes	Yes
Opik evaluation	Create annotation queues	Yes	Yes	No	No
Opik evaluation	Annotate items in queues	Yes	Yes	Yes	Yes
Opik evaluation	Edit annotation queues	Yes	Yes	No	No
Opik evaluation	Export annotation queue results	Yes	Yes	Yes	Yes
Opik evaluation	Delete annotation queues	Yes	Yes	No	No
Opik production	View online evaluation rules	Yes	Yes	No	Yes
Opik production	Manage online evaluation rules	Yes	Yes	No	No
Opik production	View alerts	Yes	Yes	No	Yes
Opik production	Manage alerts	Yes	Yes	No	No

Custom roles

To create a custom role:

Go to Admin Dashboard > Roles & Permissions.
Click Create Role and configure permissions.
Inherit from an existing role as a starting point.

Assigning roles

Roles can be updated in different places depending on the role type:

Organization roles can be updated by organization admins in Admin Dashboard > Users.
Workspace roles can be updated in Configuration > Members by any user with the Manage workspace role.

Next steps

Configure authentication with role mapping.
Manage users and assign roles.
Create service accounts with appropriate workspace access.