Phaze Roles

Last updated: November 9, 2026

Phaze has two independent role scopes: four enterprise roles and three org roles. Each role grants an access level — none, read or edit — per Admin Panel feature.

Scope	Role key	Display name	Summary
Enterprise	`member`	Enterprise Member	No admin console access
Enterprise	`billing_manager`	Enterprise Billing Manager	Manage billing and payment methods
Enterprise	`invite_manager`	Enterprise Invite Manager	Invite new members and add members to orgs
Enterprise	`admin`	Enterprise Admin	Full access to the enterprise admin console
Org	`member`	Org Member	No admin console access
Org	`it_support`	Org IT Support	View members and machines; connect to any org machine (machines with assigned users or groups need approval when connecting)
Org	`admin`	Org Admin	Full access to the org admin console. Connect to any org machine (machines with assigned users or groups need approval when connecting)

Access levels are ordered: none < read < edit. Edit implies read.

Enterprise role matrix

Only Enterprise Admin has broad access; Billing Manager is scoped to billing alone, and Member has no console access.

Feature	What it gates	Member	Billing Manager	Invite Manager	Admin
`members`	Read: list members, users, groups, SCIM groups. Edit: assign/unassign enterprise roles, delete members, edit SCIM groups and mappings	None	None	Read	Edit
`invites`	Read: list invites. Edit: bulk invite, resend, delete invites	None	None	Edit	Edit
`orgs`	Read: list orgs. Edit: create/delete orgs	None	None	Read	Edit
`org_members`	Edit: assign/unassign org members, with any org role	None	None	Edit	Edit
`settings`	Read: list SSO providers. Edit: SSO providers + config link, delete domains, group sync toggle, 2FA policy	None	None	None	Edit
`billing`	Read: billing overview, usage, invoices, payment methods. Edit: activate billing, checkout, set default / detach payment method	None	Edit	None	Edit
`api_keys`	Read: list API keys. Edit: create, update, expire, delete	None	None	None	Edit
`audit_logs`	Read: list audit logs	None	None	None	Read

Org role matrix

Org Admin has edit on every org feature; IT Support is read-only on five features, and that read is what lets it see and connect to org machines.

Feature	What it gates	Member	IT Support	Admin
`members`	Read: list members and invites. Edit: invite, resend, delete invites; change roles; remove members	None	Read	Edit
`groups`	Read: list/get groups. Edit: create, update, delete groups; add/remove group members	None	Read	Edit
`machines`	Read: admin machine list/detail. Edit: assign/unassign, set location, delete machines	None	Read	Edit
`machine_connect`	See every managed machine in the org and connect to it (see approval rules below)	None	Read	Edit
`machine_keys`	Read: list enrollment keys. Edit: create, update, delete	None	None	Edit
`locations`	Read: list/get locations. Edit: create, update, delete	None	None	Edit
`relays`	Read: list/get relays. Edit: create, update, delete, regenerate key, maintenance mode	None	None	Edit
`connections`	Read: remote connection activity	None	Read	Edit
`settings`	Read: enforced policies. Edit: update org, enforced policies	None	None	Edit

Machine connect and approval, for managed machines:

Who	Can see / connect	Skips host approval
Assigned user, or member of the machine's group	Yes	Yes
IT Support or Admin, machine unassigned (no user, no group)	Yes	Yes
IT Support or Admin, machine assigned to a user or group	Yes	No — needs approval
Org Member, not assigned	No	—

Role-change guards: the org owner's role can't be changed, and an admin can't demote themselves.

How enterprise and org roles combine

The two scopes don't inherit from each other: org endpoints check only the caller's org role, and enterprise endpoints check only the enterprise role.

Enterprise Admin gets no implicit org access. With no org membership, their org role resolves to none and org endpoints return 403. They can still add members to an org, with any org role, through the enterprise org_members feature.
Invite Manager can give itself org access. org_members edit lets it add anyone to any org with any org role, itself included and Admin included. This is by design.
Org Admin gets no enterprise access. An Org Admin who is an Enterprise Member sees no enterprise Admin Panel.
Roles are per org. One user can be Admin in one org, IT Support in another, and Member in a third.

Every combination is valid. The common shapes:

Enterprise role	Org role	Effective access
Admin	not a member	Enterprise console only; can assign orgs but can't open them
Admin	Admin	Full Enterprise and Org console
Invite Manager	not a member	Invites people and adds them to any org; can't open an org until it adds itself
Billing Manager	any	Enterprise billing only, plus whatever the org role grants
Member	Admin	That org's console only
Member	IT Support	Read-only Org console; can connect to Org machines
Member	Member	No console; connects only to their assigned or group machines

Group sync

When group sync is on, SCIM group mappings own the enterprise role, org memberships, org roles and group memberships. Manual assign/unassign, role changes and invite endpoints are hidden in the Enterprise console.

A user in several mapped groups gets one merged role per scope:

Any admin vote wins.
Otherwise a single non-member role (billing_manager or it_support) wins over member.
Two different non-member roles conflict and fall back to member. This can't happen today, since each scope has only one middle role.