Copy page

Members & Roles

Role Permissions

A Zuplo account is the top-level container for members and projects. Account roles grant permissions across that container and can also grant access to its projects. A project belongs to one Zuplo account, and project roles grant access only to that project.

The following roles are available at the account level:

• Admin: Admins have full access to the account and can manage all aspects of the account, including billing, members, and roles. Admins can also access all projects and environments in the Account.
• Developer: Developers can create and manage projects and environments in the account. They also have wide access to resources such as tunnels, custom domains, API key buckets, etc. Developers can edit preview and development resources, but not production resources.
• Member: Members of an account don't have any account level or project level permissions. Members can be granted project level permissions by an admin.

Projects can have multiple members with different roles. Some account level roles also grant access to project resources. Users can also be assigned project level roles to grant them access to specific project resources.

The following roles are available at the project level:

• Admin: Admins have full access to the project and can manage all aspects of the project, including environment variables, secrets, and members.
• Developer: Developers have access to all preview and development resources in a project. They can't modify production resources.
• Member: Members of a project can view resources in the project but can't modify them.
• AI User: Available only on AI Gateway projects. AI Users can call the project's User App with their own personal API keys and see their own usage. They can't view the rest of the project's configuration, other people's keys or usage, or project analytics. There is no AI User role at the account level. To give someone only this access, add them to the AI Gateway project with the AI User role from Members & Access. Someone who isn't in the account yet joins it as a Member.

Every project role, and the account Admin and Developer roles, can also use the User App with their own personal API keys.

Account Role Permissions

The following table outlines the permissions granted directly by each Zuplo account role.

Project Role Permissions

The following table outlines the permissions granted directly by each Zuplo project role.

The AI Pools and AI Apps rows show project-wide access granted directly by a Zuplo account or Zuplo project role. A pool role can grant additional access to a specific pool and its apps, but only when the user also has permission to view the associated Zuplo project. A pool Admin can manage the pool's settings, members, and apps, while a pool Member can access its apps. AI provider permissions come only from the user's Zuplo account or Zuplo project role; pool membership doesn't grant provider access.

The AI User App rows cover the project's User App. View lets a user find the User App URL, call it with their own personal API keys, and see their own usage and allowance. Edit covers the User App's policies and per-person budgets. Personal Keys covers creating and rolling a user's own keys. Users with AI User App Edit can also manage other people's personal keys on the project.

Permissions accumulate. Assigning AI User on a project never removes access that a user already has from their account role. For example, an account Admin who is also a project AI User keeps full access to the project.