Role-based access control for organizations and projectsEdit
Supercheck uses a 6-role RBAC system with granular permissions across organizations and projects. This page provides a complete reference of what each role can do.
Access Scope: Organization-level roles (Super Admin, Org Owner, Org Admin) have access to all projects in the organization. Project-level roles (Project Admin, Project Editor) are limited to assigned projects only. Project Viewer has read-only access to all projects.
Role
Level
Description
Super Admin
System
Platform-wide control, user management, and impersonation
Org Owner
Organization
Full organization control including deletion and billing
Variables and secrets have special permission rules to balance usability with security.
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View variables
✅
✅
✅
✅
✅
✅
Create variables
✅
✅
✅
✅
✅
❌
Edit variables
✅
✅
✅
✅
✅
❌
Delete variables
✅
✅
✅
✅
❌
❌
View secret values
✅
✅
✅
✅
✅
❌
Project Editors can create/edit variables and view secret values (needed to use secrets in tests), but cannot delete variables. This prevents accidental data loss while allowing productive work.
These roles only have access to explicitly assigned projects:
Project Admin — Full control, but only for assigned projects
Project Editor — Create/edit permissions, but only for assigned projects
Why is Project Viewer organization-wide? This design enables oversight and monitoring roles to view all projects without needing individual assignments. They cannot modify anything, making it safe for read-only visibility.
