Documentation

Roles and permissions

Who can do what inside an organisation. This table is checked against the code that enforces authorization, on every build.

Roles and permissions

Capability	Owner	Admin	Trainer
Close the organisation `org.close`	yes	no	no
Manage billing and the subscription `billing.manage`	yes	yes	no
Change organisation settings `org.manage`	yes	yes	no
Change a role, remove a member `members.manage`	yes	yes	no
Invite members `members.invite`	yes	yes	no
See the member list `members.read`	yes	yes	no
See every session in the organisation `session.read.any`	yes	yes	no
Create a session `session.create`	yes	yes	yes
See their own sessions `session.read.own`	yes	yes	yes
Edit their own sessions `session.update.own`	yes	yes	yes
Create, publish and test labs `lab.manage`	yes	yes	yes

Roles are changed under Administration > Members, by an owner or an admin.

Owner or admin?

One capability separates them: closing the organisation. An admin can do everything else, including billing and changing roles. Closing suspends the organisation and cancels the subscription; it is reversible, but not by someone still inside it.

What about learners?

A learner is not a member of the organisation. Their rights come from the session that invited them and end with it, so they do not appear in this table and none of these capabilities is available to them.

Why this page is correct

It is not written by hand. A test reads this table and compares it, capability by capability, against the one that actually decides authorization on the server. A divergence fails the build before it reaches production.