Roles and permissions
Roles decide what each person can do in KloudMate. Every member of your organization has an organization role, and a role in each workspace they can open. An Owner assigns both from Settings → Users.
How access works
Section titled “How access works”- The organization role is Owner or User. It decides who manages the organization: its users, workspaces, billing, and sign-in settings.
- The workspace role is Admin, Developer, Viewer, or a custom role. It decides what you can change in that workspace. You can have a different role in each workspace.
An Owner is an Admin in every workspace. A User sees only the workspaces where they have a role.
The workspace is the boundary for data. Everyone with a role in a workspace sees all of that workspace’s data, and there’s no filter that limits a team to part of it. If a team must see only its own data, give that team its own workspace.
Workspace roles
Section titled “Workspace roles”- Admin: Can view and change everything in the workspace.
- Developer: Can view, build and run monitoring, but can’t change workspace settings.
- Viewer: Can view, but can’t change anything.
Every role can see everything in the workspace, except the workspace settings pages, which a Viewer doesn’t see. The roles differ in what you can change, run, or share. Every role can also do its own work in a module without changing it for anyone else. For example, every role can comment on issues, add notes to incidents, star dashboards, save their own queries, and chat with the AI Assistant.
| Module | Viewer | Developer | Admin |
|---|---|---|---|
| Dashboards | Read | Read, Manage | Read, Manage, Share |
| Reports | Read | Read, Manage | Read, Manage |
| Alerts | Read | Read, Operate, Configure | Read, Operate, Configure |
| Issues | Read | Read, Operate, Configure | Read, Operate, Configure |
| Incidents | Read | Read, Operate, Configure | Read, Operate, Configure |
| Status pages | Read | Read, Post | Read, Post, Manage |
| Reliability | Read | Read, Configure | Read, Configure |
| Synthetic monitoring | Read | Read, Operate, Configure | Read, Operate, Configure |
| Workflows | Read | Read, Operate, Configure | Read, Operate, Configure, Secrets |
| AI Assistant | Use, Investigate | Use, Investigate, Configure | Use, Investigate, Configure |
| Metrics | Read | Read | Read |
| Traces | Read | Read | Read |
| Logs | Read | Read | Read, Rehydrate |
| Real User Monitoring | Read | Read, Configure | Read, Configure |
| Workspace settings | No access | Read | Every permission |
A Developer builds and runs monitoring: alert rules, incidents, SLOs, monitors, workflows, dashboards, and reports. These tasks need the Admin role:
- Change workspace settings.
- Turn on a public link for a dashboard.
- Create or brand a status page.
- Manage secret workflow variables.
- Rehydrate logs from cold storage.
For what each permission lets you do, see the permission reference.
Organization roles
Section titled “Organization roles”- Owner: Can do everything in every workspace, including billing. Owners invite users, change roles, create workspaces, set up single sign-on, and create custom roles.
- User: Can see the organization’s profile, the member list, usage, credits, and the subscription. What a User can do in a workspace comes from their workspace role.
These rules apply whenever roles change:
- Only an Owner can make someone an Owner, change an Owner’s role, or remove an Owner.
- An organization always has at least one Owner. To change the role of the only Owner, make another member an Owner first.
- Nobody can change their own roles. Ask another Owner.
Billing
Section titled “Billing”Every member can see the plan, usage, and credits on Subscription & Billing and Usage Report. Only an Owner can see invoices, change the plan, payment method, or billing details, buy credits, or change Overage Control.
Plan limits
Section titled “Plan limits”Your plan decides which modules your organization can use. If the plan doesn’t include a module, the module is closed for everyone in the organization, Owners included. Its pages show an upgrade screen instead of your data, whatever role you have.
These modules and features depend on the plan:
- Incidents, Reliability, Synthetic monitoring, Workflows, and the AI Assistant
- Smart Alerts, code profiling, and Cold Storage
- Single sign-on and custom roles
- Custom domains and branding removal for status pages
- Access to the AI Assistant from your own AI client through the MCP server
When a module closes, its background work stops too. Synthetic monitors don’t run, SLOs aren’t evaluated, workflows don’t start from any trigger, and alert sources don’t open new incidents. A workflow run that already started runs to the end.
Your data stays. When the plan includes the module again, your data and the background work come back.
API keys and AI clients
Section titled “API keys and AI clients”A personal API key, an MCP client, or an app that you approve acts as you. It gets your permissions in each workspace, and nothing more.