Overview

Previously, access control was managed entirely at the organization level. Any user added to an organization gained access to all projects under it, with a fixed set of organization-wide roles:

  • Admin – Full access to all areas
  • Member – General service access
  • Billing – Billing-related access only

These roles were not customizable and permissions could not vary between projects.

What’s Changing

To support organizations with multiple teams, tenants, or cost centers, we’ve introduced project-level roles and permissions. This allows more granular and secure access control.

Key changes include:

  • Users must now be explicitly assigned to each project
  • Roles and permissions are now managed at the project level
  • Custom roles can be created and reused across projects

Key Enhancements

Project Membership

  • Users only see and access projects they’ve been assigned to.
  • Organization membership no longer automatically grants access to all projects.
  • Organization admins can manage project assignments in:
    • The Manage Organization page (Settings > Organization > Manage Organization)
  • Project admins or custom roles that allow for project user controls can manage project users via:
    • The Project Members & Roles page (Settings > Project > Manage Organization)

Role System

System Roles (Predefined)

  • Admin – Full project control
  • Member – Most service access, no destructive actions
  • ReadOnly – View-only access
  • Base – No default permissions; starting point for fully custom roles

System roles have preset, non-editable permissions.

Custom Roles

  • Can be created from a system role template
  • Permissions can be fine-tuned (e.g., restrict termination rights)
  • Custom roles are account-scoped and reusable across any project
  • Managed in the Project Members & Roles screen

Permission Model

Each role consists of one or more permissions. These permissions govern access to UI features and API actions. Examples include:

  • Instance.Create – Create new compute instances
  • Metal.Terminate – Terminate bare metal services
  • Project.User.Add – Add users to a project
  • SshKeys.Read – View SSH keys

See full permission list in the Permissions Management UI.

UI Management Areas

Organization Management

  • Manage users at the org level
  • Set default account roles (Admin, Member, Billing)
  • Bulk manage and assign users to projects
  • Invite users to account

Project User Management

  • View, invite, and remove users from projects
  • Assign or change project roles for users

Role Management

  • View system and custom roles
  • Create, edit, and delete custom roles
  • View role permissions
  • Assign roles when inviting and editing users

Optional SSO Considerations

If your organization uses SSO:

  • SSO provides centralized login under your organization
  • Users will only see projects they’re assigned to, even if authenticated via SSO

Billing and Invoicing

  • Billing is still account-level – One invoice per account
  • Invoices will denote per-project usage to distinguish tenants or cost center
  • Users with Billing roles will only see billing views in both organization and project contexts