Understanding roles and permissions
Every member of a workspace has a role that determines what they can see and do. MCP Gateway uses three roles, each with progressively more permissions. Roles are per workspace — the same person can be an owner in one workspace and a viewer in another.
Roles at a glance
| Permission | Viewer | Editor | Owner |
|---|---|---|---|
| View workspace content | Yes | Yes | Yes |
| Create and edit content | No | Yes | Yes |
| Manage workspace settings | No | No | Yes |
| Manage team and invitations | No | No | Yes |
| Access billing | No | No | Yes |
| Manage API keys | No | No | Yes |
| Manage webhooks | No | No | Yes |
| Delete workspace | No | No | Yes |
| Transfer ownership | No | No | Yes |
"Content" here means the domain features you build on top of the MCP Gateway chassis — the viewer/editor split is wired into the permission system so your features can adopt it from day one.
Viewer
Viewers have read-only access to workspace content. They can't create or modify anything, and they don't see the Admin or Integrate sections of the sidebar. This role is useful for stakeholders who need visibility without the ability to make changes.
Editor
Editors can do everything viewers can, plus create and manage content. As you build features on the boilerplate, gate write actions behind the editor role — the editor_or_above? check and matching policies are already in place. Editors cannot manage the team, workspace settings, billing, API keys, or webhooks.
Owner
The owner has full control over the workspace: settings (name, logo, timezone), team management and invitations, billing and plan changes, API keys, webhook endpoints, and workspace deletion. Every workspace has exactly one owner.
Changing a member's role
The owner can change member roles from the Team page. New invitations are always sent as viewer or editor — ownership is never granted by invitation.
Transferring ownership is a special action: only the current owner can promote another member to owner, and doing so makes the previous owner an editor. Since each workspace has exactly one owner, this is how you hand over a workspace.
Which role should I assign?
- Viewer — for stakeholders, executives, or anyone who just needs to see what's happening
- Editor — for team members doing the day-to-day work
- Owner — for the person responsible for the workspace, its team, and its billing
Next steps
Learn about general settings to configure your workspace.