> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ferrufino-tech-solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Roles & Permissions
> Understand the three organisation-wide roles and what each one can do in FTS. A role is not scoped to a single workspace.
FTS uses a role-based access control system. Your role determines what actions you can perform: viewing cases, creating cases, reviewing, administering settings, etc.
## Role Overview
FTS has exactly three roles, arranged from least to most privilege:
**Knowledge contributor.** Create, edit and submit your own cases for review. This is the role every new member starts with.
**Quality gatekeeper.** Everything an Operator can do, plus verify cases in review and publish them.
**Manager.** Everything a Reviewer can do, plus members, roles, templates, billing and deleting the organisation — and, depending on the plan, taxonomy, the admin dashboard and the audit log.
**There is no Viewer role, no Member role and no Owner role.** Earlier versions of this page listed five roles and a permission table built on them. Only Operator, Reviewer and Admin exist. There is no read-only role at all: whoever can sign in to a workspace can also create cases in it.
## Permissions by Role
| Action | Operator | Reviewer | Admin |
| ----------------------------------- | -------- | -------- | ----- |
| **View cases in your organisation** | ✅ | ✅ | ✅ |
| **Search & semantic search** | ✅ | ✅ | ✅ |
| **Ask AI questions** ‡ | ✅ | ✅ | ✅ |
| **Create draft cases** | ✅ | ✅ | ✅ |
| **Edit your own cases** | ✅ | ✅ | ✅ |
| **Submit cases for review** | ✅ | ✅ | ✅ |
| **Edit someone else's case** | ❌ | ❌ | ✅ |
| **Verify cases in review** † | ❌ | ✅ | ✅ |
| **Publish verified cases** | ❌ | ✅ | ✅ |
| **Create case templates** | ❌ | ✅ | ✅ |
| **Manage members & roles** | ❌ | ❌ | ✅ |
| **Modify taxonomy** ‡ | ❌ | ❌ | ✅ |
| **View the audit log** ‡ | ❌ | ❌ | ✅ |
| **View the admin dashboard** ‡ | ❌ | ❌ | ✅ |
| **Manage billing** | ❌ | ❌ | ✅ |
| **Delete the organisation** | ❌ | ❌ | ✅ |
† Not your own case while the four-eyes setting is on, which is the default —
see the Reviewer section below.
‡ **Depends on the plan as well as the role.** *Added 06.08.2026:* this table
named the role as the only precondition. Measured against `lib/plan-limits.ts`:
asking AI questions, modifying the three taxonomy lists and the admin
dashboard's analytics all need at least the **Team** plan, and the audit log —
viewing *and* exporting — is **Enterprise** only. On Starter an Admin cannot do
these, and the application refuses at that point.
## Role Descriptions in Detail
### Operator
Operators are knowledge contributors, and every new member starts here. Typical use cases:
* Engineers documenting incidents and solutions
* Technicians capturing lessons learned
* Project leads maintaining team knowledge
**Can**:
* Create and edit their own cases
* Attach evidence
* Submit cases for review
* Read the cases of the organisation they belong to
**Cannot**:
* Verify or publish any case, including their own
* Edit someone else's case
* Create case templates
* Change taxonomy, members or billing
### Reviewer
Reviewers are quality gatekeepers. Typical use cases:
* Subject matter experts reviewing cases in their domain
* Team leads ensuring knowledge quality before publication
* Compliance officers auditing knowledge for accuracy
**Can**:
* Do everything an Operator can do
* Take any case out of the shared review queue and verify it, or send it back with a comment
* Publish verified cases
* Attach evidence to a case that is already verified or published
* Create case templates
**Cannot**:
* Edit someone else's case
* Manage members, roles or taxonomy
* See or change billing
A Reviewer may not verify their own case while your organisation has the four-eyes setting switched on. An Admin can switch it off in the organisation settings — then an author with the Reviewer role can verify their own work.
### Admin
Admins manage the organisation. Typical use cases:
* IT leads managing member access and permissions
* Operations managers configuring taxonomy and settings
* Team leads managing review workflows
**Can**:
* Do everything a Reviewer can do
* Invite, remove and re-role members
* Edit and delete any case, and delete any evidence
* Change the three taxonomy lists *(Team plan and above)*
* Access the admin dashboard and its analytics *(Team plan and above)*
* Access the audit log *(Enterprise only — viewing and exporting both)*
* Manage case templates
* Manage billing and payment details
* Delete the whole organisation
There is nothing above Admin. Billing and deletion sit with the Admin role, not with a separate owner.
## No assignment to categories
Reviewers cannot be **specialised on categories**, and there is no automatic selection of a reviewer from a case's category. Earlier versions of this page and of its German counterpart described both. The review queue is shared by everyone in the organisation who may review. (Open item #99.)
## Assigning & Changing Roles
**Only Admins can assign or change roles.**
To change a user's role:
1. Go to **Settings** → **Members**
2. Find the user in the list
3. Pick the new role from the drop-down in their row
The change is saved the moment you pick it: there is no *Save* button and no undo. The user is not notified — tell them yourself.
You cannot lock yourself out by accident: the product refuses to take the Admin role away from the **last** remaining admin of an organisation, and refuses to remove them. Be careful all the same when withdrawing Reviewer rights — a case can only be verified by someone who holds them.
## Inviting New Users
Admins can invite team members:
1. Go to **Settings** → **Invite Members**
2. Enter their email address
3. Select a starting role — Operator, Reviewer or Admin
4. Click **Invite**
An invitation email is sent. Once accepted, the user joins with the assigned role.
Yes. Start them as Operator and raise them to Reviewer once they are familiar with the platform. There are exactly three roles — Operator, Reviewer, Admin — and no read-only "Viewer" role.
## Default Roles for New Organisations
When you create an organisation:
* You are automatically its **Admin**
* You can invite others and assign roles as needed
* Anyone who joins without an explicitly assigned role becomes an **Operator**
## Removing Members
Admins can remove members:
1. Go to **Settings** → **Members**
2. Find the person
3. Remove them
Removing a member doesn't delete their cases. Their cases and reviews stay in the organisation as an audit trail; the seat in your plan is freed.
## Best Practices
There is no read-only role. Anyone you invite can create and edit cases, so only invite people who should be able to.
With it on, nobody can verify their own case. Switching it off is an Admin decision and removes independent review.
If your Admin is unavailable, others should be able to manage members and settings. The product also refuses to remove or demote the last remaining Admin.
Keep a record of who has Admin access and why. Update as people transition.
Understand case states and the workflow Operators and Reviewers manage.
Learn how Reviewers approve cases.