Roles & Permissions

OpenFactory uses role-based access control (RBAC) at every organizational level.

Role Hierarchy

Organization Level
├── owner
├── admin
└── member

Unit Level
├── unit_admin
├── base_creator
├── base_approver
└── member

Team Level
├── team_lead
├── variant_creator
├── variant_deployer
└── variant_viewer

Organization Roles

Owner

Full control over the organization.

Note: There is exactly one owner per organization. Ownership can be transferred but not shared.

Admin

Administrative access without full ownership.

Member

Standard organization membership.

Unit Roles

Unit Admin

Full control over a unit.

Base Creator

Create and manage base images (golden images).

Base Approver

Approve base images for deployment.

Member

Basic unit membership.

Team Roles

Team Lead

Full control over a team.

Variant Creator

Create and modify variant configurations.

Variant Deployer

Deploy variants to builds.

Variant Viewer

Read-only access to team variants.

Permission Matrix

Organization Operations

Unit Operations

Team Operations

Role Badges

Roles are displayed with color-coded badges in the UI:

Changing Roles

At Organization Level

1. Go to organization settings
2. Open Members tab
3. Click member’s current role
4. Select new role
5. Save changes

At Unit/Team Level

Same process within unit or team settings.

Role Inheritance

Higher roles inherit lower role permissions:

• owner has all admin permissions
• admin has all member permissions
• unit_admin has all unit member permissions
• team_lead has all team member permissions

Best Practices

1. Least privilege - Assign minimum necessary permissions
2. Regular audits - Review role assignments periodically
3. Document decisions - Track why roles were assigned
4. Use groups - Simplify management with groups
5. Separate concerns - Use units to isolate responsibilities