Phaze Roles

Last updated: October 22, 2026

Phaze has two independent role scopes, each with three roles. Each role grants an access level — none, read or edit — per admin-console feature.

Scope	Role key	Display name	Summary
Enterprise	`member`	Enterprise Member	No admin console access
Enterprise	`billing_manager`	Enterprise Billing Manager	Manage billing and payment methods
Enterprise	`admin`	Enterprise Admin	Full access to the enterprise admin console
Org	`member`	Org Member	No admin console access
Org	`it_support`	Org IT Support	View members and machines; connect to any org machine (machines with assigned users or groups need approval when connecting)
Org	`admin`	Org Admin	Full access to the org admin console. Connect to any org machine (machines with assigned users or groups need approval when connecting)

Access levels are ordered: none < read < edit. Edit implies read.

Enterprise role matrix

Only Enterprise Admin has broad access; Billing Manager is scoped to billing alone, and Member has no console access.

Feature	What it gates	Member	Billing Manager	Admin
`members`	Read: list members, users, invites, SCIM groups. Edit: invite, resend, delete invites; assign/unassign/delete members; edit SCIM group mappings	None	None	Edit
`orgs`	Read: list orgs. Edit: create/delete orgs, assign org members	None	None	Edit
`settings`	Read: list SSO providers. Edit: SSO providers + config link, group sync toggle, 2FA policy	None	None	Edit
`billing`	Read: billing overview, usage, invoices, payment methods. Edit: activate billing, checkout, set default / detach payment method	None	Edit	Edit
`api_keys`	Read: list API keys. Edit: create, update, expire, delete	None	None	Edit
`audit_logs`	Read: list audit logs	None	None	Read

Org role matrix

Org Admin has edit on every org feature; IT Support is read-only on five features, and that read is what lets it see and connect to org machines.

Feature	What it gates	Member	IT Support	Admin
`members`	Read: list members and invites. Edit: invite, resend, delete invites; change roles; remove members	None	Read	Edit
`groups`	Read: list/get groups. Edit: create, update, delete groups; add/remove group members	None	Read	Edit
`machines`	Read: admin machine list/detail. Edit: assign/unassign, set location, delete machines	None	Read	Edit
`machine_connect`	See every managed machine in the org and connect to it (see approval rules below)	None	Read	Edit
`machine_keys`	Read: list enrollment keys. Edit: create, update, delete	None	None	Edit
`locations`	Read: list/get locations. Edit: create, update, delete	None	None	Edit
`relays`	Read: list/get relays. Edit: create, update, delete, regenerate key, maintenance mode	None	None	Edit
`connections`	Read: remote connection activity	None	Read	Edit
`settings`	Read: enforced policies. Edit: update org, enforced policies	None	None	Edit

Machine connect and approval, for managed machines:

Who	Can see / connect	Skips host approval
Assigned user, or member of the machine's group	Yes	Yes
IT Support or Admin, machine unassigned (no user, no group)	Yes	Yes
IT Support or Admin, machine assigned to a user or group	Yes	No — needs approval
Org Member, not assigned	No	—

Role-change guards: the org owner's role can't be changed, and an admin can't demote themselves.

How enterprise and org roles combine

The two scopes don't inherit from each other.

Enterprise Admin gets no implicit org access.
Org Admin gets no enterprise access. An Org Admin who is an Enterprise Member does not see the Enterprise console.
Roles are per org. One user can be Admin in one org, IT Support in another, and Member in a third.

Every combination is valid. The common shapes:

Enterprise role	Org role	Effective access
Admin	not a member	Enterprise console only; can assign orgs but can't open them
Admin	Admin	Full Enterprise and Org console
Billing Manager	any	Enterprise billing only, plus whatever the org role grants
Member	Admin	That org's console only
Member	IT Support	Read-only Org console; can connect to Org machines
Member	Member	No console; connects only to their assigned or group machines

Group sync

When group sync is on, SCIM group mappings own the enterprise role, org memberships, org roles and group memberships. Manual assign/unassign, role changes and invite endpoints are hidden in the Enterprise console.

A user in several mapped groups gets one merged role per scope:

Any admin vote wins.
Otherwise a single non-member role (billing_manager or it_support) wins over member.
Two different non-member roles conflict and fall back to member. This can't happen today, since each scope has only one middle role.