Roles & permissions

LakeSail has two layers of access control:

Layer	What it grants	Where it attaches
Organization roles	Permissions across the whole org	Member
Team roles	Permissions within one team's resources	Member, per team

Organization roles

Organization roles are pre-defined permission bundles that apply across the entire organization. Browse them at Settings → Roles → Organization Roles. You can read the definitions, but you can't create new roles; the catalog is fixed by the platform.

Role	Access
Owner	Full organization, billing, infrastructure, and workload access
Member	Full infrastructure and workload access; read-only organization management
Billing Admin	Billing management and basic organization visibility; no technical resource access

Each organization role has an allTeams flag:

• allTeams: false: the role doesn't add the member to teams. Member and Billing Admin use this setting.
• allTeams: true: the role automatically adds members to every team in the org. Owner uses this setting, so Owners can manage every team's resources without per-team setup.

To assign an org role, open Settings → Members, click the member, and edit their org roles.

Team roles

Team roles are permission bundles that apply only inside one team. The same member can hold a different team role for each team they belong to. For example, a member may be Team Admin in data-eng, Editor in analytics, and Viewer in platform.

Like org roles, the team role catalog is fixed by the platform. Browse it at Settings → Roles → Team Roles.

LakeSail provides these team roles:

• Team Admin: full control over the team's resources and membership.
• Editor: full access to the team's infrastructure and workload resources.
• Viewer: read-only access to the team's resources.

To assign a team role, open the team, find the member, and pick the role.

Choosing between org roles and team roles

Every member has an organization role. Choose Owner for full organization control, Member for organization-wide technical access, or Billing Admin for billing without technical access.

Team roles apply to resources assigned to that team. They add permissions; they do not reduce permissions granted by an organization role. For example, assigning Viewer on a team does not make an Owner or Member read-only because both organization roles already grant broader technical access.

Use Settings → Roles to review the complete permission bundle before assigning either role type.

How permissions actually resolve

When a member tries to do something, LakeSail checks each layer:

1. Does any organization role the member holds grant this permission?
2. For team-scoped resources, does any team role the member holds on the relevant team grant this permission?

Roles are additive. If either layer grants the permission, the action is allowed.

Reviewing access

For routine access reviews:

1. Who can do what at the org level? Open Settings → Members and group by org role.
2. Who can do what to a specific resource? Open the resource and check its assigned teams, then review their members' team roles.
3. What does this role actually grant? Open the role detail page; the permission bundle is shown.

If the same person receives access through both role layers, review both before changing their access.

SSO and roles

SSO authenticates existing members. LakeSail does not import identity-provider groups or map them to organization roles or team memberships. Assign roles and team membership in LakeSail.

API reference

• Roles: list and describe organization and team roles.
• Authentication: ListPermissions for the catalog of available permission relations.