For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt, and this page is available as Markdown at /administrators/roles.md.
Docs

    Roles

    Info

    Takeaways

    • Organization roles govern account-wide access, Context, Findings, SCM connections, and workspace creation.
    • Workspace roles govern private plugins, Skills Review, publishing, evals, workspace members, and CLI scan uploads.
    • A user can hold different roles in different workspaces.

    Organization roles

    Organization roles are assigned across the Organization. An Organization admin also inherits the owner role in every workspace in that Organization.

    Permissionmemberadmin
    View Organization-owned Context, Findings, and scan historyYesYes
    View SCM connections and scan historyYesYes
    Run Code Review with tessl code review (billed to the Organization)YesYes
    Ignore or restore FindingsYes
    Manage Organization-scoped API keysYes
    Create workspacesYes
    Connect or remove SCM accounts, set scan scope, and trigger rescansYes
    Inherit owner access in every workspaceYes

    Code Review needs no workspace role. tessl code review needs a Tessl login that resolves to an Organization, and credits are billed to it. Use --org or TESSL_ORG to pick one when you belong to several.

    Context and Findings from a workspace-owned upload remain visible only to people who can view that workspace.

    For who can create, bind, and use organization environments, secrets, MCP servers, and the Linear connection, see Least privilege for environments.

    Workspace roles

    Workspace roles are assigned per workspace. To learn more about creating a workspace, see Workspace management.

    Permissionconsumermemberpublishermanagerowner
    View and install private plugins in the workspaceYesYesYesYesYes
    View workspace users and permissionsYesYesYesYes
    Generate workspace-scoped API keysYesYesYesYes
    Skills Review: review, security-scan, and fix skills from the CLI (tessl review run, tessl review run security, tessl review fix)YesYesYesYes
    Generate eval scenariosYesYesYes
    Run evalsYesYesYes
    Manage eval visibilityYesYesYes
    Create and publish pluginsYesYesYes
    Unpublish a plugin versionYesYesYes
    Roll out plugins to repositoriesYesYesYes
    Upload a scan with tessl inventory importYesYesYes
    Set up and manage workspace integrationsYesYes
    Invite users and change workspace permissionsYesYes
    Remove other managersYesYes
    Archive pluginsYesYes
    Edit or delete workspace-scoped API keysYesYes
    Add or remove workspace ownersYes
    Delete the workspaceYes