> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> What each of the four roles can see and do, as enforced on every request.

Quint has four roles, highest privilege first. Each role can do everything the role below it can. The dashboard describes them this way under **Settings › Members**:

* **Owner**: "Everything an Admin reaches, and more. The last owner cannot be removed."
* **Admin**: "Everything a Policy Writer reaches, and more."
* **Policy Writer**: "Everything a Read member reaches, and more."
* **Read**: "Every member can read all workspace data."

Roles are enforced server-side on every call. Membership is re-read on every request, so a removal or a role change takes effect on the member's next action.

## What each role can do

| Action | Read | Policy Writer | Admin | Owner |
| - | - | - | - | - |
| Read every page: Overview, Sessions, Divergence, Incidents, Shadow Enforcement, Inventory, Compliance, Audit Trail event search | Yes | Yes | Yes | Yes |
| Ask Sentinel | Yes | Yes | Yes | Yes |
| Change theme and text size | Yes | Yes | Yes | Yes |
| Set a verdict on a finding (True positive, False positive, Suspicious) | No | Yes | Yes | Yes |
| Triage an incident: status, severity, verdict, notes, assign to yourself | No | Yes | Yes | Yes |
| Assign an incident to another person | No | No | Yes | Yes |
| See scheduled summaries (policy recaps), their deliveries and the preview | Yes | Yes | Yes | Yes |
| Create, edit, delete or send a test of a scheduled summary | No | No | Yes | Yes |
| Change the risk score limit under **Settings › Notifications** | No | Yes | Yes | Yes |
| Edit and publish rules | No | No | Yes | Yes |
| Turn enforcement on or off for the workspace | No | No | Yes | Yes |
| Create and edit workloads, their keys and approvers | No | No | Yes | Yes |
| Decide an approval | No | Only if named as an approver for that workload | Only if named as an approver | Only if named as an approver |
| Terminate an agent from a session | No | No | Yes | Yes |
| Terminate a container run | No | Only if named as an approver for that workload | Yes | Yes |
| Connect, edit or remove integrations | No | No | Yes | Yes |
| Invite and remove members, change roles (only members at or below your own role) | No | No | Yes | Yes |
| Create and revoke tokens | No | No | Yes | Yes |
| Fleet settings: enforcement mode, agent rollout, token requirements | No | No | Yes | Yes |
| Read the Console actions audit log and Settings › Audit | No | No | Yes | Yes |
| Choose which features Read and Policy Writer members see | No | No | Yes | Yes |
| Transfer ownership of the workspace | No | No | No | Yes |
| Request deletion of the workspace | No | No | No | Yes |

## Two things that are not roles

**Approvers.** Deciding a held tool call is not a role. Each workload names its approvers under **Approvers › Change approvers**. The Approvals queue lists only requests you can approve, so for anyone who is not an approver it is empty. Any member can see a run's requests, with status and who decided them, on that run's page under **Workloads**; only an approver gets a **Decide** link there. A Read member is never an approver; on the Approvals page filtered to one run (`/approvals?run_id=`) it is told "Viewers can see requests but cannot decide them." See [Decide an approval](https://docs.quintai.dev/dashboard/decide-an-approval.md).

**Partner access.** If a partner operates your workspace, their delegated session can read but "cannot see or decide approvals" and cannot change integrations. You can end a partner session or revoke standing access under **Settings › Partner access**.

## Hidden features

Admins and Owners can hide parts of the product from Read and Policy Writer members under **Settings › Members › Feature visibility**. Hidden features disappear from the member's navigation on their next page load. Admins and Owners always see everything, so a change can always be undone.

## Where to change a role

**Settings › Members**, the **Manage Role** action on a member's row. Admin or Owner. See [Members and access](https://docs.quintai.dev/settings/members-and-access.md).

You can change or remove only members whose current role is at or below your own. An Admin can change or remove a Read member, a Policy Writer or another Admin. Only an Owner can change or remove an Owner, and the last owner cannot be removed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.