Manage who can do what in Northwind. You can grant only what you hold — platform controls never appear here.
6 members · base role sets the floor, groups add on top
Member
Base role
Groups
Joined
Actions
Marco Belli
—
Apr 2026
owner · locked
Nadia Fournier (you)
Engineering
Apr 2026
Priya Raman
EngineeringOn-call
May 2026
Tunde Okafor
Contractors
Jun 2026
Sam Ihejirika
Contractors
Jul 2026
Lena Vos
—
Jul 2026
New group
Extra capabilities — only ones you hold are selectable
Engineering
Manager · + relays.view.org · 4 members
NFPRJS+1
Contractors
Member · time-boxed access · 2 members
TOSI
On-call
Member · + members.approve · 1 member
PR
Org roles · system, read-only
Capability
member
manager
admin
owner
See members · members.view
✓
✓
✓
✓
See all org relays · relays.view.org
✓
✓
✓
✓
Invite members · members.invite
—
✓
✓
✓
Approve requests · members.approve
—
✓
✓
✓
Manage groups · groups.manage
—
—
✓
✓
Assign roles · members.role.assign
—
—
✓
✓
Remove members · members.remove
—
—
✓
✓
Manage workspaces · workspaces.manage
—
—
✓
✓
Autojoin domains · autojoin.manage
—
—
✓
✓
Rename org · org.rename
—
—
✓
✓
Delete org · transfer ownership
—
—
—
✓
The firewall. As an admin you can grant a group only capabilities you hold yourself, within this org — members.role.assign and owner-only actions stay locked, and platform capabilities never appear. Superadmins manage the platform plane separately in the console. Model: briefs/SPEC.rbac.md.