Roles & Permissions

Rival uses two layers of permissions:

1. Org roles - what a member can do across the organization as a whole.
2. Resource roles - what a member can do with a specific tool, agent, or workflow.

The two layers are independent. A high org role doesn’t automatically grant access to every resource, and a Member needs explicit assignment - directly on a tool, or through a team - to do anything beyond browsing.

Org roles

Every member of an organization has one of three org roles: Owner, Admin, or Member. Assign and change these in Settings → Members (/user/members).

Capability	Owner	Admin	Member
View organization	Yes	Yes	Yes
Create tools, agents, and workflows	Yes	Yes	Yes
Invite and manage members	Yes	Yes	No
Create and manage teams	Yes	Yes	No
Edit any tool, agent, or workflow in the org	Yes	Yes	No
Publish agents and workflows as Public	Yes	Yes	No
Grant and revoke agent seats	Yes	Yes	No
Manage API keys and secrets	Yes	Yes	No
Edit Org Profile	Yes	Yes	No
Verify phone	Yes	No	No
Manage billing, plan, payouts	Yes	No	No
Delete the organization	Yes	No	No

Owner is the person who created the organization. Each organization has exactly one Owner and the role cannot be transferred through the UI. Contact support@rival.io if you need to transfer ownership.

Admin is the right role for a trusted collaborator who should run the organization day-to-day but shouldn’t control billing or payouts.

Member is the default role. New Members can browse the organization and create their own tools, agents, and workflows, but they don’t automatically get access to other members’ work - they need to be assigned at the tool level or added to a team.

Resource roles

Resource roles control what a member can do with a specific tool, agent, or workflow. They’re assigned through a team that holds the resource (Settings → Teams, /user/teams), or for tools, directly in the tool’s settings.

There are two roles, and they apply to every kind of resource: Executor and Editor.

• Editor - the active builder role. Can run the resource and change it.
• Executor - can run the resource and inspect how it’s set up, but can’t change it. Use it for collaborators who need to use something but shouldn’t modify it.

What each role means in practice differs slightly per resource type.

Tools

Capability	Editor	Executor
View tool code and config	Yes	Yes
Run the tool	Yes	Yes
View run history	Yes	Yes
Edit code and configuration	Yes	No
Publish new versions	Yes	No

Agents

Capability	Editor	Executor
Open the agent and see how it’s set up	Yes	Yes
Adopt your own copy	Yes	Yes
Chat with the agent	Yes	Yes
Authorise your own connectors (Gmail, Calendar, …) for it	Yes	Yes
View the activity log	Yes	Yes
Change instructions, personality, guardrails, tools, knowledge	Yes	No
Change rituals, schedules, and evals	Yes	No
Publish as Private or Organizational	Yes	No
Publish as Public	Yes	No

Publishing an agent as Private or Organizational is done by its creator, and publishing as Public needs an org Owner or Admin. Executors see the agent’s settings drawer in a read-only state with a notice naming their role. Connectors are the exception: authorising a connector links your account, not the agent’s configuration, so an Executor can still do it - otherwise they could be allowed to run the agent with no way to satisfy what running it requires.

Workflows

Capability	Editor	Executor
Open the workflow and read the graph	Yes	Yes
Run, pause, and stop runs	Yes	Yes
View run history	Yes	Yes
Edit the graph, rename, change the icon, save	Yes	No
Export the workflow	Yes	No
Publish or unpublish as Private or Organizational	Yes	No
Publish as Public	Yes	No
Delete the workflow or clear its run history	Yes	No

Publishing a workflow as Public needs an org Owner or Admin, and deleting it or clearing its run history is done by its creator or an Owner or Admin. The workflow builder tells an Executor their level and disables the controls they can’t use, so the limit is visible before it’s hit.

Who always has Editor access

Some people are Editors on a resource regardless of any team role:

• The creator of a tool, agent, or workflow always has Editor access to it.
• Org Owners and Admins have Editor access to everything in the organization.

Publishing to the public marketplace is the one thing a team Editor role never unlocks - it reads the org role, which a team role doesn’t raise. A team Editor can publish a workflow as Private or Organizational and no further.

Agent seats

On plans with a seat cap (Team and Enterprise), running agents also needs an agent seat, which is separate from any role. A member with an Executor or Editor role but no seat can see and open agents but cannot run them. Owners and Admins grant seats from the Members tab of a team or from Billing → Seats. See Subscription.

How the two layers combine

The two layers are independent. A few examples:

• A Member with an Executor role on a team that holds one agent can chat with that agent but can’t change it, and can’t see any other private resources in the organization.
• A Member on two teams that both hold the same workflow - Executor on one, Editor on the other - gets Editor. The highest role across teams wins.
• An Admin can manage all members and teams, and can edit any tool, agent, or workflow without being on a team. They still can’t publish someone else’s agent as Private or Organizational; that stays with its creator.
• An Owner has full org access but should still assign themselves a tool role if they want to appear on the tool’s contributor list.

Where to assign roles

To change	Go to
A member’s org role	/user/members
A member’s role on tools, agents, and workflows	/user/teams - the Members tab of a team that holds them
A member’s role on a single tool	The tool’s settings page
Which tools, agents, and workflows a team holds	/user/teams - the Tools, Agents, and Workflows tabs
Agent seats	/user/teams Members tab, or Billing → Seats

If access is blocked

If you can’t see or do something:

1. Check your org role in /user/members - are you a Member when you need to be an Admin?
2. Check your team role - are you on a team that holds the resource, and is your role on that team high enough? Executor can run but not change; Editor can do both.
3. For agents, check that you hold an agent seat if your plan has a seat cap.

All of these need to be right for access to work. If you’re still blocked, ask an Owner or Admin in your organization.