> ## Documentation Index > Fetch the complete documentation index at: https://docs.corepillar.ai/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > The four organization roles, their permission strings, the hub roles they map to, and what each role can do in ModelHub and AgentHub. Access in CorePillar has two layers. Your **organization role** (Owner, Admin, Editor, or Viewer) carries a list of permissions. Your **hub role** (Super Admin, Admin, AI Builder, or User) is derived from it and decides which product you can use and which settings you see. ## Organization roles Every organization is created with these four roles. The permission lists are fixed; you cannot create custom roles or edit them in the app. | Permission | Owner | Admin | Editor | Viewer | | - | :-: | :-: | :-: | :-: | | `manage_org_settings` | Yes | Yes | | | | `manage_members` | Yes | Yes | | | | `manage_model_keys` | Yes | Yes | Yes | | | `manage_agents` | Yes | Yes | Yes | | | `run_agents` | Yes | Yes | Yes | | | `view_traces` | Yes | Yes | Yes | Yes | | `manage_metrics` | Yes | Yes | Yes | | | `manage_billing` | Yes | | | | | `export_rl_data` | Yes | Yes | | | | `manage_sso` | Yes | Yes | | | | `manage_comments` | Yes | Yes | Yes | Yes | * **Owner** is the person who created the organization. You cannot invite someone as Owner, and User Management does not offer it. * **Admin**, **Editor**, and **Viewer** are the roles you can invite with. * In a few places AgentHub shows the Editor role as **Member** (the General tab's "Your role", and the SSO default-role choice "Member (Editor)"). ## Hub roles | Hub role | Who has it | Label in the app | | - | - | - | | **Super Admin** | People on CorePillar's per-site super admin list. Not stored in your organization and not editable from it. | Super Admin | | **Admin** | Owner or Admin in the organization | Admin | | **AI Builder** | Editor | AI Builder | | **User** | Viewer | User | Your hub role is worked out per organization. The badge under your name at the bottom of the sidebar shows it. Super admins act with the full Owner permission set in every organization they belong to, whatever their role there. They still need a membership to open an organization. ## What each role can reach | | Super Admin | Admin | AI Builder | User | | - | :-: | :-: | :-: | :-: | | ModelHub chat and personal usage | Yes | Yes | Yes | Yes | | ModelHub organization-wide usage view | Yes | Yes | | | | AgentHub pages | Yes | Yes | Yes | ModelHub-only screen | | AgentHub AI Usage, whole organization | Yes | Yes | | | | AgentHub AI Usage, own usage only | Yes | Yes | Yes | | | Settings: General, User Management | Yes | Yes | | | | Settings: SSO, Tracing keys, Platform access | Yes | | | | | Create organizations | Yes | Yes | | | A User who opens any AgentHub page sees "Your account has ModelHub access only" with **Go to ModelHub** and **Sign out**. A brand-new person with no organization yet can always create their first one during onboarding, and becomes its Owner. On ModelHub, everyone gets the same two pages, Chat and Usage. ModelHub's other routes redirect to chat before the page loads, whatever the role. See [ModelHub access control](/modelhub/admin/access-control). ## Permission to action These are the checks AgentHub applies today. "Or" means either permission is enough. | Action | Needs | | - | - | | Invite members, change roles, save User Management | `manage_members` | | Create a project | `manage_org_settings` or `manage_members` | | Create a project from an Overview template | Owner or Admin role, or `manage_org_settings` | | Create or revoke tracing keys | `manage_org_settings` | | Configure SSO | `manage_sso` | | Add or revoke provider keys, add or remove project models | `manage_model_keys` or `manage_agents` | | Create, edit, or delete evaluators and collections | `manage_agents` or `manage_org_settings` | | Evaluate a trace, run evaluations | `run_agents` or `manage_agents` | | Run Cost Calculator scenarios | `run_agents` or `manage_agents` | | Generate scenarios, execute Cost Calculator runs, synthetic data | `manage_agents` | | See the organization-wide AI Usage view | Admin or Super Admin hub role | | Manage platform access | Super Admin | In practice: * **Admins** can do everything in AgentHub except the three super-admin settings tabs. * **AI Builders** can configure models and keys, run the Cost Calculator, and build and run evaluations. They cannot invite people, create projects or organizations, create tracing keys, or see other people's usage. * **Users** work only in ModelHub. `view_traces`, `manage_metrics`, `manage_billing`, `export_rl_data`, and `manage_comments` are stored on the roles but no screen checks them yet. Trace pages require organization membership plus AgentHub access, which Viewers do not have. ## Rules that protect the organization User Management enforces these when you save: * You cannot change your own role or remove yourself. * Only a super admin can add, change, or remove admins. Admins see the **Admins** box read-only. * An organization's last Owner cannot be demoted or removed. When an Okta user signs in for the first time, only an explicit group mapping changes the role of someone who is already a member, so a default role never demotes an existing Owner or Admin. See [SSO with Okta](/agenthub/settings/sso-okta). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.