> For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt.

# Roles

:::info

**Takeaways**

- Organization roles govern account-wide access, Context, Findings, SCM connections, and workspace creation.
- Workspace roles govern private plugins, Skills Review, publishing, evals, workspace members, and CLI scan uploads.
- A user can hold different roles in different workspaces.

:::

## Organization roles

Organization roles are assigned across the Organization. An Organization admin also inherits the owner role in every workspace in that Organization.

| Permission                                                            | member | admin |
| --------------------------------------------------------------------- | ------ | ----- |
| View Organization-owned Context, Findings, and scan history           | Yes    | Yes   |
| View SCM connections and scan history                                 | Yes    | Yes   |
| Run Code Review with `tessl code review` (billed to the Organization) | Yes    | Yes   |
| Ignore or restore Findings                                            |        | Yes   |
| Manage Organization-scoped API keys                                   |        | Yes   |
| Create workspaces                                                     |        | Yes   |
| Connect or remove SCM accounts, set scan scope, and trigger rescans   |        | Yes   |
| Inherit owner access in every workspace                               |        | Yes   |

Code Review needs no workspace role. `tessl code review` needs a Tessl login that resolves to an Organization, and credits are billed to it. Use `--org` or `TESSL_ORG` to pick one when you belong to several.

Context and Findings from a workspace-owned upload remain visible only to people who can view that workspace.

For who can create, bind, and use organization environments, secrets, MCP servers, and the Linear connection, see [Least privilege for environments](/administrators/least-privilege-environments.md).

## Workspace roles

Workspace roles are assigned per workspace. To learn more about creating a workspace, see [Workspace management](/reference/cli-commands.md#workspace-management).

| Permission                                                                                                                              | consumer | member | publisher | manager | owner |
| --------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------ | --------- | ------- | ----- |
| View and install private plugins in the workspace                                                                                       | Yes      | Yes    | Yes       | Yes     | Yes   |
| View workspace users and permissions                                                                                                    |          | Yes    | Yes       | Yes     | Yes   |
| Generate workspace-scoped API keys                                                                                                      |          | Yes    | Yes       | Yes     | Yes   |
| Skills Review: review, security-scan, and fix skills from the CLI (`tessl review run`, `tessl review run security`, `tessl review fix`) |          | Yes    | Yes       | Yes     | Yes   |
| Generate eval scenarios                                                                                                                 |          |        | Yes       | Yes     | Yes   |
| Run evals                                                                                                                               |          |        | Yes       | Yes     | Yes   |
| Manage eval visibility                                                                                                                  |          |        | Yes       | Yes     | Yes   |
| Create and publish plugins                                                                                                              |          |        | Yes       | Yes     | Yes   |
| Unpublish a plugin version                                                                                                              |          |        | Yes       | Yes     | Yes   |
| Roll out plugins to repositories                                                                                                        |          |        | Yes       | Yes     | Yes   |
| Upload a scan with `tessl inventory import`                                                                                             |          |        | Yes       | Yes     | Yes   |
| Set up and manage workspace integrations                                                                                                |          |        |           | Yes     | Yes   |
| Invite users and change workspace permissions                                                                                           |          |        |           | Yes     | Yes   |
| Remove other managers                                                                                                                   |          |        |           | Yes     | Yes   |
| Archive plugins                                                                                                                         |          |        |           | Yes     | Yes   |
| Edit or delete workspace-scoped API keys                                                                                                |          |        |           | Yes     | Yes   |
| Add or remove workspace owners                                                                                                          |          |        |           |         | Yes   |
| Delete the workspace                                                                                                                    |          |        |           |         | Yes   |