Roles and what they allow
What admins, members and the owner can do, and what each brain role (Read, Draft, Write, Approve) allows.
Everyone in an organisation has two roles. Their org role decides what they can do in running the organisation. Their brain role decides what they can do inside brains.
Org roles
| Role | Can |
|---|---|
| Member | Use every brain they can reach, with their brain role. |
| Admin | Everything a member can, plus manage members, settings, connections and billing. Admins can always approve changes. |
| Owner | Everything an admin can, and reach every brain, including restricted ones. Only the owner can hand ownership to someone else. |
There is one owner. Ownership isn't a role you pick; it moves only when the owner hands it over.
Brain roles
Each role includes the ones before it.
| Role | Can |
|---|---|
| Read | Read, search and ask. Can't change anything. |
| Draft | Make changes, which are all sent for approval. |
| Write | Save directly, except in protected folders, and add brains and routines. |
| Approve | Approve changes, and save in protected folders. |
A member's brain role applies in every brain they can reach. Admins and the owner always act as Approve.
Some files need an admin, whatever the brain role: a brain's settings in .brain/, and the org-wide brain's skills/ and instructions/.
Organisation-wide switches
Under Settings, then Manage members, then For all members, admins can set:
- Brain role for new members: the role an invite starts with.
- Members can add brains: off means only admins and the owner can.
- Members can add routines: off means only admins and the owner can.
Agents and roles
The assistant, Claude when you connect it to ako, and ako in Slack act with the role of the person using them. They never approve anything, even for an admin: their changes to protected folders always wait for a person.
A routine acts as its owner, and also never approves.
Personal brains
Members on the Read role don't have a personal brain.