Workspace Permissions Matrix

Clear, role-by-role access rules across every workspace entity type.

Use this matrix when you need a quick, reliable answer to who can do what across chatbots, tools, assistants, prompts, and personas in a workspace.

Last Reviewed

February 15, 2026

Scope

Workspace-level role and capability rules

Permission Formula

Chatbots, Tools, Assistants

Effective Permission = Workspace Role Capability AND Entity Capability AND Plan/Feature Gate

Prompts, Personas

Effective Permission = Workspace Role Capability AND Plan/Feature Gate

Role Baseline Capabilities

RoleContributeReadRunUpdateDeleteTransfer
OwnerYesYesYesYesYesYes
AdminYesYesYesYesYesNo
ContributorYesYesYesYesNoNo
ReaderNoYesYesNoNoNo
GuestNoNoYesNoNoNo

Cross-Entity Role Matrix

RoleChatbotsToolsAssistantsPromptsPersonas
OwnerFull accessFull accessFull accessFull accessFull access
AdminView, run, edit, delete (no transfer)View, run, edit, delete (no transfer)View, run, edit, delete (no transfer)View, add/edit, deleteView, add/edit, delete
ContributorView, run, edit (no delete/transfer)View, run, edit (no delete/transfer)View, run, edit (no delete/transfer)View, add/edit (no delete)View, add/edit (no delete)
ReaderView and run onlyView and run onlyView and run onlyView onlyView only
GuestRun-only, limited entry pointsNo workspace management accessNo workspace management accessNo workspace management accessNo workspace management access
Note:
UI controls can occasionally appear in edge cases, but backend authorization is always final and enforced.

Feature Gates That Still Apply

  • Plan limits and feature entitlements can disable actions even when role permissions allow them.
  • Transfer actions are explicitly role-capped and additionally checked by capability flags.
  • Organization-level admin/owner privileges may grant elevated fallback access in some flows.

FAQ

How are effective permissions calculated?+

Permissions are computed using role capability, entity capability (where applicable), and plan/feature gates. The backend remains authoritative for every protected action.

Q1

Why can an Admin edit and delete but not transfer?+

Transfer is role-capped by default. Admin can manage most actions, but transfer to another workspace or organization is restricted unless explicitly allowed.

Q2

What is the difference between Contributor and Reader?+

Contributor can create and update workspace resources. Reader can view and run where allowed, but cannot create, edit, delete, or transfer.

Q3

Why can Guest sometimes run but not open workspace pages?+

Guest access is intentionally limited. Some run entry points may be available, but workspace management/detail pages are blocked.

Q4

Do prompts and personas use entity-level permission flags?+

In current implementation, prompt and persona flows are primarily workspace-capability driven and then filtered by plan/feature gates.

Q5

Can plan features still block actions if my role allows them?+

Yes. Role access does not bypass product/plan gates. If a feature is disabled in your plan, the action remains unavailable.

Q6

Tip:
Need implementation-level clarification for an audit? Contact support@hyperleap.ai and include your workspace id and role setup.

Related Pages