---
title: "Roles in the web app"
description: "The permissions of each role in the web app, who can change roles and invite people, and how the service enforces them whatever the page shows."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles in the web app

The page hides every control your role cannot use. That is a convenience, not the protection: the service checks the role on every request, so a request made another way is refused with `403 forbidden` and recorded in the [audit log](/web-app/audit-log/) as denied. The full role model is in [Teams and roles](/teams-and-roles/).

```js run
assert.deepEqual([...ROLE_ACTIONS.viewer], ["read"]);
assert.ok(ROLE_ACTIONS.member.includes("manage_tokens"));
assert.ok(!ROLE_ACTIONS.member.includes("manage_members"));
assert.ok(ROLE_ACTIONS.admin.includes("manage_members"));
assert.ok(!ROLE_ACTIONS.admin.includes("manage_team"));
assert.ok(ROLE_ACTIONS.owner.includes("manage_team"));
```

## Permissions by role

| In the app | Viewer | Member | Admin | Owner |
| --- | --- | --- | --- | --- |
| Read every view | yes | yes | yes | yes |
| Create and edit issues, memory and projects | no | yes | yes | yes |
| Dismiss a review finding, re-run CI | no | yes | yes | yes |
| Approve a deploy, roll one back, change policy | no | no | yes | yes |
| Create and revoke agent tokens | no | yes | yes | yes |
| Change roles, remove members, invite people | no | no | yes | yes |
| Read, verify and export the audit log | no | no | yes | yes |
| Manage the team itself | no | no | no | yes |

## Members and invitations

In **Settings > Members** everyone can read the list. Owners and admins can change a role, remove a member and send or revoke invitations. Nobody can give out more authority than they hold: only an owner can make someone an owner, and a team always keeps at least one owner.

Removing a member takes effect at once. Their sessions stop working and the agent tokens they created are revoked.

An invitation is bound to one email address and works once. If no email could be sent, the page shows the invitation link a single time.

## Agent tokens

**Settings > Agent access** lists the tokens agents hold and lets you revoke one. Nobody creates a token there: agents sign in from the CLI, with `overlane auth login` when a person can approve a code, or on their own for a repository connected through the Overlane GitHub App. Read more in [Agent sign-in](/agent-tokens/).

Source: https://docs.overlane.app/web-app/roles/index.mdx