Roles and permissions

Each member, and each API token, has one role in a tenant. The table is the platform’s own permission list; the site’s tests fail if it drifts.

Permission	owner	admin	approver	member
tenant.manage Invite people, change roles, create API tokens, set the HubSpot token and source keys, connect GitHub	✓	✓	—	—
motion.publish Push motions and custom sources, which also updates tenant.yaml, crm.yaml and the practice CRM's seed	✓	✓	✓	—
motion.promote Make a version live	✓	✓	✓	—
batch.open Open a batch	✓	✓	✓	✓
batch.view See batches, motions, sources, members and the CRM connection	✓	✓	✓	✓
batch.answer Answer questions	✓	✓	✓	✓
batch.approve Approve or reject changesets, release checkpoints, retry, pause, resume and upgrade batches	✓	✓	✓	—
source.manage Publish and promote custom sources, and set the secrets they use	✓	✓	✓	—

Handles narrow it further

Some actions also need your handle to be named in the motion:

Action	Needs the permission, and
Answer a question	your handle owns the question’s queue, or is in approvers
Approve or reject a changeset	your handle is in approvers
Release a checkpoint, upgrade a batch, accept suggestions	your handle is in approvers
Make a version live	your handle is in the approvers of the version live now, or, for a motion’s first version, of that version

Retrying, pausing and resuming a batch only need the permission.

Owners and admins

Owners and admins have the same permissions, with three differences that only owners have:

• making someone an owner, or changing an owner’s role;
• removing an owner;
• creating API tokens with the owner role.

A tenant always keeps at least one owner.

API tokens

A token has a role and a handle, like a member, and acts as that handle. Its handle is the creator’s own, or one no member has. A token never has more than its creator’s role.