Enterprise
Custom Roles
Create roles with granular permissions beyond the default Owner, Admin, and Member roles.
Custom Roles allow you to define fine-grained access control policies tailored to your organization's needs.
Default Roles
| Role | Description |
|---|---|
| Owner | Full access to all resources and settings |
| Admin | Manage users, projects, and services — cannot modify billing |
| Member | View and deploy within assigned projects |
Creating a Custom Role
- Navigate to Settings → Roles
- Click Create Role
- Enter a role name and description
- Configure permissions for each resource type:
Available Permissions
Each permission is an individual toggle, grouped by resource. Grant only the actions a role needs.
| Resource | Actions |
|---|---|
| Users | read, create, update, delete |
| Projects | create, delete |
| Services | read, create, delete |
| Deployments | read, cancel |
| Environments | read, create, delete |
| Service env vars | read, write |
| Project shared env vars | read, write |
| Volumes | read, create, delete |
| Backups | read, create, update, delete, restore |
| Volume backups | read, create, update, delete, restore |
| Schedules | read, create, update, delete |
| Domains | read, create, delete |
| Certificates | read, create, delete |
| Registries | read, create, delete |
| Git providers | read, create, delete |
| SSH keys | read, create, delete |
| Servers | read, create, delete |
| S3 destinations | read, create, delete |
| Notifications | read, create, update, delete |
| Monitoring | read |
| Audit logs | read |
| Docker | read |
| Traefik files | write |
| API / CLI | read |
Assigning Roles
Roles are assigned at the organization level and can be further scoped to specific projects and environments. A user can have different roles in different projects.