Skip to main content
Access in CorePillar has two layers. Your organization role (Owner, Admin, Editor, or Viewer) carries a list of permissions. Your hub role (Super Admin, Admin, AI Builder, or User) is derived from it and decides which product you can use and which settings you see.

​
Organization roles

Every organization is created with these four roles. The permission lists are fixed; you cannot create custom roles or edit them in the app.
  • Owner is the person who created the organization. You cannot invite someone as Owner, and User Management does not offer it.
  • Admin, Editor, and Viewer are the roles you can invite with.
  • In a few places AgentHub shows the Editor role as Member (the General tab’s “Your role”, and the SSO default-role choice “Member (Editor)”).

​
Hub roles

Your hub role is worked out per organization. The badge under your name at the bottom of the sidebar shows it. Super admins act with the full Owner permission set in every organization they belong to, whatever their role there. They still need a membership to open an organization.

​
What each role can reach

A User who opens any AgentHub page sees “Your account has ModelHub access only” with Go to ModelHub and Sign out. A brand-new person with no organization yet can always create their first one during onboarding, and becomes its Owner. On ModelHub, everyone gets the same two pages, Chat and Usage. ModelHub’s other routes redirect to chat before the page loads, whatever the role. See ModelHub access control.

​
Permission to action

These are the checks AgentHub applies today. “Or” means either permission is enough. In practice:
  • Admins can do everything in AgentHub except the three super-admin settings tabs.
  • AI Builders can configure models and keys, run the Cost Calculator, and build and run evaluations. They cannot invite people, create projects or organizations, create tracing keys, or see other people’s usage.
  • Users work only in ModelHub.
view_traces, manage_metrics, manage_billing, export_rl_data, and manage_comments are stored on the roles but no screen checks them yet. Trace pages require organization membership plus AgentHub access, which Viewers do not have.

​
Rules that protect the organization

User Management enforces these when you save:
  • You cannot change your own role or remove yourself.
  • Only a super admin can add, change, or remove admins. Admins see the Admins box read-only.
  • An organization’s last Owner cannot be demoted or removed.
When an Okta user signs in for the first time, only an explicit group mapping changes the role of someone who is already a member, so a default role never demotes an existing Owner or Admin. See SSO with Okta.