Role-based access control for organizations and projectsEdit
Supercheck uses a 6-role RBAC system with granular permissions across organizations and projects. This page provides a complete reference of what each role can do.
Access Scope: Organization-level roles (Super Admin, Org Owner, Org Admin) have access to all projects in the organization. Project-level roles (Project Admin, Project Editor) are limited to assigned projects only. Project Viewer has read-only access to all projects.
Role
Level
Description
Super Admin
System
Platform-wide control, user management, and impersonation
* Project Admin and Project Editor permissions apply only to their assigned projects.
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
✅
Create
✅
✅
✅
✅
✅
❌
Edit
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Run/Trigger
✅
✅
✅
✅
✅
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
✅
Create
✅
✅
✅
✅
✅
❌
Edit
✅
✅
✅
✅
✅
❌
Pause/Resume
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
✅
Cancel
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
❌
Create
✅
✅
✅
✅
✅
❌
Edit
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
✅
Create
✅
✅
✅
✅
✅
❌
Edit
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View
✅
✅
✅
✅
✅
✅
Create
✅
✅
✅
✅
✅
❌
Edit
✅
✅
✅
✅
✅
❌
Delete
✅
✅
✅
✅
❌
❌
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View services & incidents
✅
✅
✅
✅
✅
✅
Create & update services
✅
✅
✅
✅
✅
❌
Delete services
✅
✅
✅
✅
❌
❌
Create & update incidents
✅
✅
✅
✅
✅
❌
Delete incidents
✅
✅
✅
✅
❌
❌
Investigate stored evidence
✅
✅
✅
✅
✅
❌
Configure & investigate live connectors
✅
✅
✅
✅
❌
❌
Approve topology suggestions
✅
✅
✅
✅
❌
❌
* Project Admin and Project Editor permissions apply only to their assigned projects. Project Editors can investigate stored evidence and manage incidents, but cannot query or configure live external connectors (sre_connector:investigate).
Variables and secrets have special permission rules to balance usability with security.
Action
Super Admin
Org Owner
Org Admin
Project Admin*
Project Editor*
Project Viewer
View variables
✅
✅
✅
✅
✅
✅
Create variables
✅
✅
✅
✅
✅
❌
Edit variables
✅
✅
✅
✅
✅
❌
Delete variables
✅
✅
✅
✅
❌
❌
View secret values
✅
✅
✅
✅
✅
❌
Project Editors can create/edit variables and view decrypted secret values (needed to use secrets in tests), but cannot delete variables. This prevents accidental data loss while allowing productive work with encrypted secrets.
These roles only have access to explicitly assigned projects:
Project Admin — Full control, but only for assigned projects
Project Editor — Create/edit permissions, but only for assigned projects
Why is Project Viewer organization-wide? This design enables oversight and monitoring roles to view all projects without needing individual assignments. They cannot modify anything, making it safe for read-only visibility.
