Team Access and Roles

Runta organizations use role-based access control (RBAC). Every member has one of three roles: Owner, Admin, or Developer. The role expands into a fixed set of organization permissions that gate dashboard navigation and actions.

Manage people from the dashboard under Settings → Team access.

The matrix below covers capabilities that appear in the current dashboard UI. Some backend permissions exist for future surfaces and are intentionally omitted here.

Roles

Role	Best for	What they can do in the dashboard
Owner	Organization founders and primary admins	Full dashboard access, including team management, secrets, API keys, billing, and ownership transfer
Admin	Platform and security operators	Manage members, secrets, API keys, and runtimes; view usage; no payment management or ownership transfer
Developer	Day-to-day builders	Create and operate runtimes; use configured secrets; no team, secrets, billing, or API-key management UI

Invitations can only grant Admin or Developer. Ownership is never assigned through an invite; use ownership transfer instead.

Only an Owner can invite someone as Admin. Admins can invite Developer members.

Permission Matrix

Dashboard capability	Owner	Admin	Developer
Open Runtimes and operate runtimes (create, start/stop/pause, terminal, delete)	Yes	Yes	Yes
Open Secrets and manage organization secrets	Yes	Yes	No
Use configured secrets while running workloads	Yes	Yes	Yes
Open Token X-Ray and Token Savings	Yes	Yes	No
Open Usage	Yes	Yes	No
Open Payments and manage payment methods	Yes	No	No
Open Settings → Team access	Yes	Yes	No
Invite, change role, and remove members	Yes	Yes	No
Transfer ownership	Yes	No	No
Leave the organization	No*	Yes	Yes
Manage personal SSH keys under Settings → Developer	Yes	Yes	Yes
Create and revoke API keys under Settings → Developer	Yes	Yes	No

*Owners leave by transferring ownership first. The last active owner cannot leave or be removed until another member becomes owner.

Admins can manage Developer members. Only an Owner can invite, change, or remove another Admin.

Invite a Collaborator

1. Sign in to the Runta dashboard.
2. Open Settings.
3. In the Organization section, find Team access.
4. Enter the invitee’s email address.
5. Choose Developer, or Admin if you are an owner.
6. Select Invite.

Runta emails a secure invitation link that expires after 7 days. The dashboard also shows a single-use copy link if email delivery is delayed; only the latest link remains valid.

Pending invitations can be resent or revoked from the same Team access panel.

Accept an Invitation

1. Open the invitation link from the email or the shared copy link.
2. Sign in with the invited email address if you are not already signed in.
3. Accept the invitation.

After acceptance, the new member can switch to that organization from the organization switcher.

Change a Member’s Role

Owners and admins can change eligible members between Admin and Developer from Settings → Team access:

1. Open Settings.
2. Find the member in the Team access table.
3. Choose the new role from the role control.

You cannot promote someone to Owner from this control. Use ownership transfer. Admins can change Developer members only.

Remove a Member

Removing a member revokes their access to the organization and its resources:

1. Open Settings → Team access.
2. Select Remove next to the member.
3. Confirm the change.

Owners can remove admins and developers. Admins can remove developers.

Transfer Ownership

Only an owner can transfer ownership, and only to another active member:

1. Open Settings → Team access.
2. Select Make owner next to the target member.
3. Confirm the transfer.

After a successful transfer:

• The target member becomes Owner
• The previous owner becomes Admin

Leave an Organization

Non-owner members can leave from Settings → Team access:

1. Open Settings → Team access.
2. Select Leave on your own row.
3. Confirm.

If you are the only owner, transfer ownership first.

Runtimes and Secrets

In the current dashboard:

• Owners, Admins, and Developers can open Runtimes and operate them.
• Owners and Admins can open Secrets and manage organization secrets.
• Developers do not see the Secrets page, but workloads can still use secrets that owners or admins already configured.

CLI and SDK access use the same role model through scoped API keys.

API Keys

Organization API keys live under Settings → Developer → Runta API Keys. Only owners and admins can create or revoke them.

API key scopes are chosen at creation time and must stay within both:

1. The callable service-account scopes Runta supports for keys
2. The creator’s organization role permissions

A key never gains more privilege than its creator’s role.

See Create a Runta API Key for setup steps.

Recommended Role Patterns

Team size	Suggested setup
Solo founder	Keep one Owner; invite contractors as Developer
Small product team	One Owner, one backup Admin, engineers as Developer
Platform team	Shared Admin group for secrets and API keys; feature teams as Developer

Keep the owner count small, prefer Developer for everyday builders, and reserve Admin for people who must manage members, secrets, and API keys.