Roles and Permissions

When you invite team members to your organization or workspace, you'll need to choose what level of access to give them. This guide explains what each permission level allows users to do, helping you understand team roles and what access each permission level provides.

Workspaces and Organizations

Aptlystar has two kinds of workspaces:

• Personal workspaces live under your individual account. The number you can create depends on your plan.
• Shared (organization) workspaces live under an organization and are available on Team and Enterprise plans. Any organization Owner or Admin can create them. Internal members invited to a shared workspace join the organization and count toward your seat total. Existing Aptlystar users who already belong to another organization can be added as external workspace members instead, giving them access to the workspace without adding them to your organization roster or using one of your seats.

Workspace Limits by Plan

How to Invite Someone to a Workspace

Workspace Permission Levels

When inviting someone to a workspace, you can assign one of three permission levels:

Internal Members vs External Workspace Members

Workspace permissions are separate from organization membership:

• Internal organization members belong to your organization, appear in the organization roster, and count toward your seat total. Invite new teammates this way when they should be part of your company or team in Aptlystar.
• External workspace members have access only to the workspace they are invited to. They keep their own organization membership, do not appear in your organization roster, and do not count toward your organization's seats. Use external access for clients, partners, contractors, or collaborators who already use Aptlystar in another organization.

External workspace members still receive a workspace permission level — Read, Write, or Admin — and that permission controls what they can do inside the workspace.

What Each Permission Level Can Do

Here's a detailed breakdown of what users can do with each permission level:

Read Permission

Perfect for: Stakeholders, observers, or team members who need visibility but shouldn't make changes

What they can do:

• View all workflows in the workspace
• See workflow execution results and logs
• Browse workflow configurations and settings
• View environment variables (but not edit them)

What they cannot do:

• Create, edit, or delete workflows
• Run or deploy workflows
• Change any workspace settings
• Invite other users

Write Permission

Perfect for: Developers, content creators, or team members actively working on automation

What they can do:

• Everything Read users can do, plus:
• Create, edit, and delete workflows
• Run and deploy workflows
• Add, edit, and delete workspace environment variables
• Use all available tools and integrations
• Collaborate in real-time on workflow editing

What they cannot do:

• Invite or remove users from the workspace
• Change workspace settings
• Delete the workspace

Admin Permission

Perfect for: Team leads, project managers, or technical leads who need to manage the workspace

What they can do:

• Everything Write users can do, plus:
• Invite new users to the workspace with any permission level
• Remove users from the workspace
• Manage workspace settings and integrations
• Configure external tool connections
• Delete workflows created by other users

What they cannot do:

• Delete the workspace (only the workspace owner can do this)
• Remove the workspace owner from the workspace

Workspace Owner vs Admin

Every workspace has one Owner (the person who created it) plus any number of Admins.

Workspace Owner

• Has all Admin permissions
• Can delete the workspace
• Cannot be removed from the workspace
• Can transfer ownership to another user

Workspace Admin

• Can do everything except delete the workspace or remove the owner
• Can be removed from the workspace by the owner or other admins

Common Scenarios

Adding a New Developer to Your Team

1. Organization level: Invite them as an Organization Member
2. Workspace level: Give them Write permission so they can create and edit workflows

Adding a Project Manager

1. Organization level: Invite them as an Organization Member
2. Workspace level: Give them Admin permission so they can manage the team and see everything

Adding a Stakeholder or Client

1. Organization level: If they should not join your organization, add them as an External workspace member
2. Workspace level: Give them Read permission so they can see progress but not make changes

Environment Variables

Users can create two types of environment variables:

Personal Environment Variables

• Only visible to the individual user
• Available in all workflows they run
• Managed in Settings, then go to Secrets

Workspace Environment Variables

• Read: see variable names; values stay hidden unless you administer that secret
• Write: add new variables, and edit or delete ones you created
• Admin: add, edit, delete, and view the values of any workspace variable
• Workspace variables are workspace credentials, so they follow the Credential Access rules below
• Available to all workspace members; if a personal variable has the same name, the personal one takes priority

Credential Access

Workspace credentials — OAuth connections, service accounts, and workspace environment variables — have two roles of their own:

• Credential Member: can use the credential in workflows.
• Credential Admin: can use it and also edit, delete, and share it.

These roles follow your workspace role:

• Workspace Admins are automatically Credential Admins of every shared credential in the workspace. Because organization Owners and Admins are workspace Admins everywhere, they are Credential Admins too. These automatic roles are fixed and cannot be removed from the credential member list.
• Read and Write members are Credential Members by default. They can use shared credentials but cannot edit, delete, or share them unless someone makes them a Credential Admin. You are always an admin of credentials you create.
• Personal environment variables stay private to their owner and are never shared with workspace admins.

A Credential Admin can both use and manage a credential, so a workspace Admin can run workflows that use any shared OAuth connection in the workspace — including one another member added.

Best Practices

Start with Minimal Permissions

Give users the lowest permission level they need to do their job. You can always increase permissions later.

Use Organization Structure Wisely

• Make trusted team leads Organization Admins
• Most team members should be Organization Members
• Reserve workspace Admin permissions for people who need to manage users

Review Permissions Regularly

Periodically review who has access to what, especially when team members change roles or leave the company.

Environment Variable Security

• Use personal environment variables for sensitive API keys
• Use workspace environment variables for shared configuration
• Regularly audit who has access to sensitive variables

Organization Roles

An organization has three roles: Owner, Admin, and Member.

Organization Owner

What they can do:

• Everything an Admin can do
• Transfer organization ownership to another user
• Only one Owner exists per organization

Organization Admin

What they can do:

• Invite and remove team members from the organization
• Create new shared workspaces under the organization
• Manage billing, seat count, and subscription settings
• Access every shared workspace in the organization as a workspace Admin automatically, including administering the credentials inside them
• Promote members to Admin or demote Admins to Member

Organization Member

What they can do:

• Access shared workspaces they've been specifically invited to
• View the list of organization members
• Cannot invite new people, create shared workspaces, or manage organization settings