The built-in owner / editor / viewer roles cover most teams. Enterprise customers often need finer-grained roles — e.g. a "Support Editor" who can edit docs but never touch billing, or a "Compliance Reviewer" who can read everything (including audit log) but write nothing.
Custom RBAC lets you define those roles with an explicit permission matrix and assign them to org members.
Where to manage
Project → Settings → Roles. Click New role, give it a name, tick the permissions you want, save. Existing members continue using their built-in role until you reassign them.
Permission vocabulary
Stable strings — never invent new ones, the platform ignores unknown values:
| Permission | Grants |
project.read | Read project + pages + analytics |
project.write | Edit pages, commit config |
project.delete | Delete the project |
settings.write | Change project settings (domain, branding, access, etc.) |
billing.read | View subscription + usage |
billing.write | Change plan, manage billing |
members.invite | Invite new members |
members.remove | Remove members |
access.manage | Set access mode + rotate password |
webhook.manage | Create / edit / delete webhooks |
api_key.manage | Create / revoke API keys |
audit.read | View the audit log |
Plan availability
| Plan | Custom roles |
| Free | — |
| Pro | — |
| Team | — |
| Enterprise | ✅ |
Lower tiers continue using the built-in owner / editor / viewer set.
Notes
Custom role assignment overlays the built-in role. When a member has a custom role assigned, that role's permissions win.
The legacy
ownerrole is preserved on every org so billing + plan changes always have someone authorised.Permission strings are stable — don't tie code to label changes; tie it to the slug.