Roles & permissions

Understand Admin, Builder, Runner, and Reviewer roles in Draft & Goal: what each role can do in the Studio and how org roles differ from workflow share access.

Overview#

Every member of an organization has one Studio role: Admin, Builder, Runner, or Reviewer. The role controls what they see in the sidebar, which Settings tabs they can open, and how they work with workflows.

The four Studio roles#

Role	Purpose
Admin	Full organization control: members, quotas, org credentials, and visibility on all workflows
Builder	Create, edit, and run workflows; use org integrations and Brand Kits
Runner	Run workflows they can access; manage personal integrations only
Reviewer	Approve or reject Human in the Loop tasks only — no Builder or Runner Studio surfaces

Hierarchy (higher includes lower capabilities where relevant): Admin → Builder → Runner → Reviewer.

Action matrix#

Action	Admin	Builder	Runner	Reviewer
View accessible workflows	✅	✅	✅	❌
Run workflows	✅	✅	✅	❌
Create / edit workflows	✅	✅	❌	❌
Delete workflows	✅	Own / shared write	❌	❌
See all org workflows	✅	Shared + owned	Shared + owned	❌
Manage folder visibility	✅	Own folders	❌	❌
Manage org integrations	✅	Use (not always add/delete)	Personal only	❌
Brand Kits	✅	✅	❌	❌
Models (LLMs), API keys, MCP	✅	❌	❌	❌
Settings → Teams	✅	❌	❌	❌
Settings → Monthly quotas / Models & costs	✅	View where available	❌	❌
Human in the Loop review portal	✅*	✅*	✅*	✅

* Admins, Builders, and Runners can review when assigned as reviewers on a HITL node. Reviewer-role users use the dedicated /reviews surface only.

Sidebar access by role#

What appears in the left navigation depends on the role:

Area	Admin	Builder	Runner	Reviewer
Dashboard	✅	✅	✅	❌
Workflows	✅	✅	✅	❌
Files	✅	✅	❌	❌
Models (LLMs)	✅	❌	❌	❌
Integrations (under Builder)	✅	✅	❌*	❌
API keys	✅	❌	❌	❌
MCP Servers	✅	❌	❌	❌
Workflows Library	✅	✅	❌	❌
Data Hub	✅	✅	❌	❌
Brand Kits	✅	✅	❌	❌
Reviews portal (/reviews)	—	—	—	✅ (primary)

* Runners access Integrations from a top-level entry focused on personal credentials.

Reviewer mode#

Users with the Reviewer role are redirected to the approval experience:

• Reviews (/reviews) — queue of runs and batches waiting for their decision
• Profile — edit personal details; role is read-only

They do not get the Builder canvas, workflow list, or Dashboard. See Reviewers & approvals.

Org role vs workflow share access#

Concept	Where it is set	Values
Organization role	Settings → Teams	Admin, Builder, Runner, Reviewer
Workflow share access	Share on the canvas	Runner (read/run), Builder (write)
Folder visibility	Folder menu → Visibility & members	Private, Group, Organization

A member can be a Runner at org level and still receive Builder share access on one workflow if someone shares it with write rights. Admins always see all active workflows in the organization.

See Workflow access & sharing for folder and Share details.

Admin safety rules#

When managing roles in Settings → Teams:

• You cannot remove your own Admin role
• You cannot change another Admin’s role or profile
• You cannot remove the last Admin in the organization
• You cannot deactivate yourself or another Admin

These rules keep the organization from locking out all administrators.

Next steps#