Skip to main content
Organization roles are available on the Pro plan and above. Some feature roles and capabilities require the Enterprise plan.
Gumloop’s roles are additive. A member can hold multiple roles per scope (organization or team), and their effective permissions are the union of every role they hold. Every member implicitly holds the baseline Member role; layer additional roles on top to grant access to specific areas.
For granular, feature-by-feature restrictions (app allowlists, tool restrictions, concurrency limits), see Custom Roles. That is a separate, complementary system that restricts what organization roles grant. A user can hold multiple custom roles at the same time.

​
How it works

Union of permissions

A user with {Member, Analytics} can do everything Member and Analytics allow. Revoking one role does not remove permissions granted by another.

Member is implicit

Every org member automatically holds Member. It is not shown in the Manage Access picker and cannot be removed without removing the user from the org.

Scopes are independent

Organization roles apply across the org. Team roles apply inside a single team. A user can be a Team Admin on one team and a Team Member on another.

Admin vs Feature roles

Admin roles (Admin, Manager) grant broad authority. Feature roles (Security, Developer, Analytics) grant scoped access to one area.

​
Organization roles

Admin

Full control: billing, SSO, members, organization Brain, and every feature area.

Manager

Member operations, organization Brain, connectors, and analytics. No billing or security.

Member

Implicit baseline. Use agents, skills, and personal connectors.

Security

Custom roles, app policies, AI model access, Agent Defaults, and MCP server settings.

Developer

Build and test Hosted MCPs.

Analytics

Organization analytics, usage, and data export.

​
Admin

Role ID: admin  ·  Group: Admin  ·  Scope: Organization

Can access

  • Billing, subscription, and credit limits
  • SSO, SAML, and SCIM
  • All member operations
  • Organization connectors
  • Team access and team settings
  • Audit logs
  • AI model access, app policies, custom roles
  • Analytics, usage, and data export
  • Connector Activity, Hosted MCPs, and Proxied MCPs (when enabled)

Can assign

Admin, Manager, Security, Developer, Analytics.
Scope limits: Admin can manage organization settings, including billing and SSO, but the role does not unlock features or raise limits beyond your organization’s plan.
When to assign: Organization owners, finance leads, and IT admins. Keep the count small since Admin includes billing and SSO.

​
Manager

Role ID: manager  ·  Group: Admin  ·  Scope: Organization

Can access

  • Invite, remove, and manage members
  • Organization connectors
  • Organization Brain
  • Analytics, usage, and data export

Can assign

Analytics, Member.
Cannot do: Change billing, SSO, AI model access, app policies, custom roles, or audit logs. Cannot grant Admin, Manager, Security, or Developer.
When to assign: Team leads and ops managers who handle day-to-day onboarding and need usage visibility without billing or security authority.

​
Member

Role ID: member  ·  Group: Feature  ·  Scope: Organization and Team  ·  Baseline: Yes

Can access

  • Create and use agents and skills
  • Read organization metadata
  • Create teams
  • Manage personal connectors
  • Leave the organization or a team

Can assign

Nothing.
Cannot do: Any management action: billing, members, connectors, analytics, or security controls.
When to assign: Automatic. Every organization member holds Member implicitly. It cannot be removed without removing the user from the organization.

​
Security

Role ID: security  ·  Group: Feature  ·  Scope: Organization  ·  Plan: Enterprise

Can access

Can assign

Developer.
Cannot do: Billing, SSO, member management, or audit logs. Cannot grant Admin, Manager, or Security.
When to assign: Security engineers, platform leads, and compliance owners who configure guardrails without taking on billing or SSO.

​
Developer

Role ID: developer  ·  Group: Feature  ·  Scope: Organization

Can access

  • Create hosted MCP servers and open a server’s page from a direct link
  • Agents and skills via Member

Can assign

Nothing.
Cannot do: Any organization management action. Cannot view audit logs or open Connector Activity. The Hosted MCPs and Proxied MCPs pages don’t appear in Developer’s Settings sidebar.
When to assign: Builders and integration engineers who need to develop and test Hosted MCPs. Granted by Admin or Security.
Developer is hidden in the Manage Access UI if Hosted MCPs and Proxied MCPs are not enabled on the organization.

​
Analytics

Role ID: analytics  ·  Group: Feature  ·  Scope: Organization  ·  Plan: Enterprise

Can access

  • Organization analytics dashboard
  • Usage limits and credit consumption
  • Data export

Can assign

Nothing.
Cannot do: Member management, connectors, security controls, or billing.
When to assign: Finance, FP&A, and data analysts who need usage visibility without member management authority. Granted by Admin or Manager.

​
Team roles

Teams use a simpler two-role system.

​
Team Admin

Role ID: admin (team scope)  ·  Scope: Team

Can access

  • Team agents and skills
  • Team credentials
  • Team analytics
  • Team membership

Can assign

Team Admin, Team Member.
Cannot do: Anything outside the team. Team roles do not grant organization-level authority.
When to assign: People who own a team’s content end-to-end, including onboarding teammates and managing credentials.

​
Team member

Role ID: member (team scope)  ·  Scope: Team  ·  Baseline: Yes

Can access

Read access to team content.

Can assign

Nothing.
Cannot do: Manage team membership, credentials, or team roles.
When to assign: Automatic. Every team member holds Team Member implicitly.
Organization Admins can manage membership and roles on every team in the organization, regardless of their own team-level role.

​
Managing roles

Roles are assigned and revoked individually from the Manage Access sheet. You pick the exact combination of roles the user should hold. This is not a promote or demote action.
Manage Access sheet with a search box and Admin roles, General roles, and Custom Roles groups, each role paired with a View details link.
1

Open the members page

Go to Organization Members or a team’s Members tab.
2

Open Manage Access

Click the three-dot menu next to the member and choose Manage Access. The sheet opens with every role the member currently holds pre-selected.
3

Toggle and save

Check or uncheck any available role and click Save. Roles you are not authorized to assign are hidden. Effective permissions update immediately.

​
Adding a new member with roles

Pre-assign organization roles when you invite someone so they land with the right permissions as soon as they accept.
Add Member to Organization modal with fields for email, a multi-select Roles picker showing Member, Manager, Security selected, a Custom Roles selector, and a Teams selector.
  • Roles is a multi-select. Every invitee gets Member implicitly; pick any additional roles your own role lets you assign.
  • Custom Roles picks one or more Custom Roles that apply subtractive restrictions on top of the organization roles. New invitees automatically join the default custom role; you can layer additional custom roles on top.
  • Teams adds the invitee to one or more teams.
You can invite suggested teammates from your connected Slack workspace and send the invitation by Slack DM instead of email. Choose active internal teammates with email addresses; bots, guests, and external Slack Connect users are not eligible. Recipients use Accept invite in the DM to join. Suggestions do not add anyone or assign roles automatically. Slack delivery uses your default connected Slack workspace and is limited to 25 recipients per request. For larger groups, send separate batches. Additional recipients are not sent a DM, and failed Slack delivery does not automatically send email. If delivery fails or the person is not suggested, invite them by email instead.

​
Best practices

Every user starts as Member automatically. Add the narrowest additional roles that match their responsibilities. You can always add more later.
If someone only needs analytics visibility, grant Analytics, not Manager. Keep the high-authority list short.
Custom roles, app policies, and AI model access no longer require Admin. Grant Security so platform and security teams can own guardrails without billing or SSO.
Additive roles make it easy to accumulate extras. Run a quarterly review and remove roles that are no longer needed.

​
Removing a member

Remove a member from the three-dot menu on Organization Members, or from a team’s Members tab to remove them from that team only. Removing a member from the organization, or deprovisioning them through SCIM, stops every trigger they run right away: Gumloop pauses their agent triggers and deletes their workflow triggers. Admins can then transfer or delete the member’s resources from the Recently left tab, as described below. For a full handoff checklist, see Keep agents running after someone leaves.

​
Transfer or delete a removed member’s resources

Organization Admins can hand a removed member’s resources to someone else, or delete them, from the Recently left tab on Organization → Members.
  1. Open the Recently left tab. Left within filters by when they left (7 days, 30 days, 90 days, or Any time). Remaining resources shows what each person still owns.
Organization Members page on the Recently left tab, with Left within 30 days and a Remaining resources column listing agents, skills, workflows, and knowledge sources
  1. Open the member’s menu and select Transfer resources.
  2. Choose Transfer their resources to hand them to a new owner, or Delete their resources to delete them permanently. Deleting can’t be undone.
  3. For a transfer, choose the new owner. Under Advanced settings, Choose destination for resources in personal space picks the team that receives items from the member’s personal space. Items in other teams stay in those teams.
  4. Click Next, review the summary, and confirm.
Transfer resources page with Transfer their resources selected, Transfer from a removed member to Choose the new owner, Advanced settings, Resources to transfer, and Resources to delete
The page covers the member’s agents, skills, workflows, custom nodes, team and organization knowledge sources, and triggers. Personal knowledge sources sync the member’s own accounts, so they’re deleted instead of transferred. Each person who receives resources gets an email listing what moved to them, including anything they need to connect again or turn back on. How triggers transfer:
  • Triggers on the member’s agents move with the agent.
  • A trigger that was running restarts for the new owner, or stays paused when it needs setup first, such as choosing an account.
  • A transferred webhook trigger gets a new URL and stays paused. The new owner turns it on and gives the sender the new URL.
  • You can only delete copies of a shared trigger, not transfer them.
Only custom agents transfer. The member’s Gumball isn’t listed, because each workspace keeps its own.

​
How permissions resolve

When someone takes an action, Gumloop checks three things. The action goes through only if all three agree.

1. Roles

The union of everything your organization and team roles grant at the relevant scope. This is the ceiling on what you can do.

2. Item sharing

For a specific agent, an Owner can add you as an Owner or a User (see Agent Access). For a skill, the owner can grant you Editor, Viewer, or Use only. Sharing overrides the default per item.

3. Custom roles

Your Custom Roles can subtract from what roles and sharing allow. For example, they can block certain apps or tools. A user can hold multiple custom roles, and the effective restriction is composed across all of them.
In short: organization and team roles set the ceiling, sharing adjusts access per item, and custom roles can subtract on top.

​
What does view-only access to a settings page look like?

Each organization settings page checks two permissions: one to open the page and one to change it. Every built-in role that can change a settings page can also open it, so for most pages, the pages a role can open are the pages it can edit. General is the exception. Every organization member can open General from Settings in the bottom-left sidebar, under Organization, to see settings such as Organization Name and Organization ID. Only roles allowed to change organization settings can save there. When you open a settings page you can view but not change, the page shows the note “You can view these settings. Ask an admin to change them.” Its edit and create controls are disabled, so you can read the saved configuration without starting a change.

​
Role comparison

Users with multiple roles get the union of the “Yes” columns. Team Admin can assign Team Admin and Team Member inside the team. Team Member is implicit and has read access to team content.

Custom roles

Additive restriction roles that subtract from what organization roles grant.

Connector policies

Allow or block specific apps for users.

AI model access controls

Restrict which AI models users can call.

Audit logging

Track every administrative action.

Teams

Group users and content for shared access.