Roles & permissions

Organization roles

Role	Scope
Owner	Full responsibility for the Organization.
Administrator	Organization administration, including available member and settings controls.
Member	Work within the Projects and resources available to the membership.

The server evaluates the current membership on every protected request.

Advanced Reporting uses two tenant capabilities in addition to the ordinary membership and Project checks:

Capability	Owner	Administrator	Member
reports.advanced.use	Use when the App and commercial gates succeed	Use when the App and commercial gates succeed	Use when the App and commercial gates succeed
reports.advanced.manage_shared	Create, update, promote, and delete Organization-shared reports and dashboards	Create, update, promote, and delete Organization-shared reports and dashboards	No shared-management actions
attributes.manage	Administer the Organization Attribute vocabulary: create, rename, disable, re-enable, retire, and manage allowed values	Same authority as Owner for Attributes	Read-only discovery of the vocabulary

Personal definitions can be mutated only by their owner. Shared reads and execution still reapply current membership, Project/data access, App enablement, entitlement, and reports.advanced.use; a shared definition does not grant access to its sources.

Premium Application permissions

Members can view Premium App availability and enabled state through apps.view. Organization administrators can enable or disable an entitled App through apps.manage. Only an Organization owner has billing.manage authority for Premium quotes, purchases, renewal cancellation, renewal resumption, billing summaries, and hosted payment links. An Enterprise administrator role does not substitute for Organization membership or owner billing authority.

Personal Access Token scopes

PAT scopes describe what an automation credential may request; they do not replace membership:

Scope family	Examples
Organization	organization:read, organization:members:read
Project	project:read, project:write
Organization Milestone	milestone:read, milestone:write
Work Item	work_item:read, work_item:write, work_item:delete
Discussion	comment:read, comment:write, comment:delete
Files	attachment:read, attachment:write, attachment:delete
Advanced Reporting	report:read, report:write
Profile	profile:read

Attribute vocabulary administration through the Public API requires organization:attributes:read / organization:attributes:write scopes (intersected with the attributes.manage capability for mutations); these arrive with the Public API Attribute transport. Existing tokens do not gain Attribute authority by default. Until that transport is available, existing PATs—including Project-only grants—cannot administer Attributes. Administrative operations recheck active Organization membership on the server; Enterprise and platform roles alone do not grant vocabulary authority.

Mutation scopes imply their matching read scope where documented. See Personal Access Tokens for the complete matrix and restrictions.

Advanced schedules: members may schedule readable sources to themselves and manage their own schedules. Owners/administrators with reports.advanced.manage_shared manage all schedules and may distribute shared sources to active Organization members. Personal sources remain owner-only. Current permissions are checked before execution/email and again at link access. See Advanced Reporting and its Public API.