Roles & Permissions

Rhesis controls what each member can do through roles, assigned at the organization level and, optionally, overridden per project.

Community vs. Enterprise

Built-in roles

Built-in roles are fixed and cannot be edited or deleted.

Organization roles vs. project roles

A project-level role can only add to what your organization role already grants — it can never take access away. This mirrors how GitLab and Google Cloud IAM handle nested scopes: a narrower scope (project) can elevate access above a broader scope (organization), but it never restricts what the broader scope already grants. If you have both an organization role and an explicit role on a specific project, the higher-level role always wins for that project.

• No organization role at all: the explicit project role (if any) is the whole answer — there’s no broader role to compare it against.
• Org Admin or Owner: implicit access to every project already. An explicit project role only matters if it’s higher, in which case it elevates further for that one project.
• Org Member or Viewer: must be added to a project (given a project role, or added as a plain member) before they get any access there. Once added, the higher of their org role and any explicit project role applies.

Examples

• A contractor with no organization role is added to one project only, with a Member role on that project. They have no access to any other project — there’s no org role to fall back on.
• An org Viewer is granted an explicit Owner role on a single project. They keep Viewer access everywhere else and gain full Owner access on that one project (elevation).
• An org Owner is also explicitly assigned a lower Admin role on one project (for example, from a default project setup). Their access on that project stays at Owner level — the lower project role does not restrict them.
• An org Admin never needs to be added to a project explicitly. Admin and Owner get implicit access to every project.

Custom roles

Owners can create custom roles with a hand-picked set of permissions (role:manage is Owner-only by default, Admin is excluded).

• A role’s permissions and level can never exceed the creator’s own access.
• New capabilities added in future releases do not automatically appear in existing custom roles. An admin must add them explicitly (fail-closed by design).
• Deleting a custom role reassigns org-level holders to None and clears project-level holders back to their org role.

Managing roles in the UI

1. Go to Organization Settings, Roles tab.
2. Review the Built-in Roles card (read-only “Details” view) and the Custom Roles table.
3. Click “New role”: name it, add a description, optionally copy permissions from a built-in template, then set access per area (Test Resources, Observability, Infrastructure, Administration) using the View / Edit / Manage graded control. A live “This role can” summary shows the effective permissions.
4. Assign roles from the Team page (role column or member drawer for org roles), from a project’s Members tab (project-level roles), or inline during the invite flow.

Manage roles via API

curl -X POST "https://api.example.com/rbac/roles" -H "Authorization: Bearer $RHESIS_API_KEY" -H "Content-Type: application/json" -d '{
    "name": "qa-lead",
    "display_name": "QA Lead",
    "description": "Full access to test resources, read-only elsewhere",
    "scope": "organization",
    "permission_names": ["test_set:read", "test_set:create", "test_set:update", "test_run:read"]
}'

Revoking access

Assign the None role at the org tier to revoke a member while keeping them in the organization. None is not a valid project-tier assignment (the API returns a 422 error), since it has no meaning there.

Notes

• Role changes can take up to 45 seconds to propagate (permission cache TTL). Not a bug.
• Create and edit controls may appear a moment after the page renders while permissions are still loading. Not a bug.
• The org’s last remaining Owner cannot be demoted or removed.

Related pages

• Single Sign-On
• API Clients
• Organizations & Team
• Self-Hosting