Roles & Permissions

Galtea uses role-based access control. Every member of your organization has one role that decides what they can see and change. This page lists the four organization roles and the actions each one can perform. Actions cover the standard operations (Create, Read, Update, Delete) plus a soft delete (a logical delete that hides a record without removing it). Many permissions are conditional, shown as a short rule in the cell.

Roles

OWNER: Manages users and resources in their own organization. Can permanently delete only Sessions and User Groups; every other entity is soft delete at most.
MEMBER: Day-to-day access in their organization: view and contribute, with limited edits. Can permanently delete only Sessions and User Groups; every other entity is soft delete at most.
HUMAN_EVALUATOR: Read-only across the organization, plus may annotate AI metrics and submit human evaluations.
READER: Read-only across the organization. Cannot create, update, or delete anything.

Each cell shows what a role can do for that action. ✅ means allowed and ❌ means not allowed. A short rule (for example, “If product in own org”) means the action is allowed only when that rule is true at the time, checked against your organization and the record’s ownership.

Permissions by area

Identity & Organization

User

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If target in own org	❌	❌	❌
Read	If target in own org	If target in own org	If target in own org	If target in own org
Update	If target in own org	Only self	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If target in own org, not self, and not an admin	❌	❌	❌

Organization

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	❌	❌	❌	❌
Read	Own org	Own org	Own org	Own org
Update	Own org	❌	❌	❌
Delete	❌	❌	❌	❌
Soft delete	❌	❌	❌	❌

Subscription

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	❌	❌	❌	❌
Read	Own org	Own org	Own org	Own org
Update	If subscription in own org and billed through Stripe	If subscription in own org and billed through Stripe	❌	❌
Delete	❌	❌	❌	❌
Soft delete	❌	❌	❌	❌

User Group

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If group in own org	If group in own org	❌	❌
Read	If group in own org	If group in own org	If group in own org	If group in own org
Update	If group in own org	If group in own org	❌	❌
Delete	If group in own org	If group in own org	❌	❌
Soft delete	If group in own org	If group in own org	❌	❌

Test Assets

Product

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If product in own org	If product in own org	❌	❌
Read	If product in own org	If product in own org	If product in own org	If product in own org
Update	If product in own org	If product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If product in own org	If product is theirs (by userId)	❌	❌

Version

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent product in own org	If parent product in own org	❌	❌
Read	If parent product in own org	If parent product in own org	If parent product in own org	If parent product in own org
Update	If parent product in own org	If parent product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent product in own org	If parent product in own org	❌	❌

Test

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent product in own org	If parent product in own org	❌	❌
Read	If parent product in own org, or test is global	If parent product in own org, or test is global	If parent product in own org, or test is global	If parent product in own org, or test is global
Update	If parent product in own org	If parent product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent product in own org	If parent product in own org	❌	❌

Test Case

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent test in own org	If parent test in own org	❌	❌
Read	If parent test in own org, or test is global	If parent test in own org, or test is global	If parent test in own org, or test is global	If parent test in own org, or test is global
Update	If parent test in own org	If parent test in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent test in own org	If parent test in own org	❌	❌

Specification

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent product in own org	If parent product in own org	❌	❌
Read	If parent product in own org	If parent product in own org	If parent product in own org	If parent product in own org
Update	If parent product in own org	If parent product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent product in own org	If parent product in own org	❌	❌

Connections

Endpoint Connection

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If connection’s product in own org	If connection’s product in own org	❌	❌
Read	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org
Update	If connection’s product in own org	If connection’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If connection’s product in own org	If connection’s product in own org	❌	❌

Phone Connection

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If connection’s product in own org	If connection’s product in own org	❌	❌
Read	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org
Update	If connection’s product in own org	If connection’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If connection’s product in own org	If connection’s product in own org	❌	❌

WebRTC Connection

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If connection’s product in own org	If connection’s product in own org	❌	❌
Read	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org	If connection’s product in own org
Update	If connection’s product in own org	If connection’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If connection’s product in own org	If connection’s product in own org	❌	❌

Evaluation & Results

Session

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If session’s product in own org	If session’s product in own org	❌	❌
Read	If session’s product in own org	If session’s product in own org	If session’s product in own org	If session’s product in own org
Update	If session’s product in own org	If session’s product in own org	❌	❌
Delete	If session’s product in own org	If session’s product in own org	❌	❌
Soft delete	If session’s product in own org	If session’s product in own org	❌	❌

Evaluation

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Read	If evaluation’s product in own org	If evaluation’s product in own org	If evaluation’s product in own org	If evaluation’s product in own org
Update	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Annotate AI metric	✅	✅	✅	❌
Human evaluation	✅	✅	✅	❌

Annotating or submitting human evaluations also requires membership in the relevant User Group; the table shows the role-level gate only. Inference Result

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If result’s product in own org	If result’s product in own org	❌	❌
Read	If result’s product in own org	If result’s product in own org	If result’s product in own org	If result’s product in own org
Update	If result’s product in own org	If result’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If result’s product in own org	If result’s product in own org	❌	❌

Trace

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If trace’s product in own org	If trace’s product in own org	❌	❌
Read	If trace’s product in own org	If trace’s product in own org	If trace’s product in own org	If trace’s product in own org
Update	If trace’s product in own org	If trace’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If trace’s product in own org	If trace’s product in own org	❌	❌

Comment

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	✅	✅	❌	❌
Read	✅	✅	✅	✅
Delete	✅	If the comment’s author	❌	❌

Free-form reviewer text on an inference result. Access also requires the parent inference result to be in your organization. Deleting is a soft delete; you may delete your own comments, and organization owners may delete any. Monitor

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If product in own org	If product in own org	❌	❌
Read	If product in own org	If product in own org	If product in own org	If product in own org
Update	If product in own org	If product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If product in own org	If product in own org	❌	❌

Reference Data

Metric

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If metric in own org	If metric in own org	❌	❌
Read	If in own org, or global	If in own org, or global	If in own org, or global	If in own org, or global
Update	If metric in own org	If metric in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If metric in own org	If metric in own org	❌	❌

Model

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If model in own org	If model in own org	❌	❌
Read	If in own org, or global	If in own org, or global	If in own org, or global	If in own org, or global
Update	If model in own org	If model in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If model in own org	If model in own org	❌	❌

Analytics & Insights

Analytics

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Read	If data in own org	If data in own org	If data in own org	If data in own org

Notes

Read-only roles: READER and HUMAN_EVALUATOR can read exactly what a MEMBER can read (the same organization scope). They cannot create, update, or delete. HUMAN_EVALUATOR additionally may annotate AI metrics and submit human evaluations; READER cannot.
Organization scope: “In own org” means the record (or its parent, such as a Product) has an organizationId equal to the signed-in user’s organization. This keeps each client organization’s data separate.
Parent scope: For nested records (Version, Test, Evaluation, and so on) access is derived from the parent’s organization. Example: a Version belongs to a Product, and the Product belongs to an Organization. An Evaluation is reached through session to version to product.
Global records: Some records (Metric, Model, and a Test with no product) can be global, meaning not tied to one organization. Global records are readable by every role in addition to their own organization’s records.
Hard delete: Each entity table has two delete rows. Soft delete hides a record without removing it. Delete is a permanent removal, shown as allowed only for Session and User Group (OWNER and MEMBER, within their own organization); for every other entity it is denied to all roles listed here.

Getting Started

Core Workflows

Production & Monitoring

Advanced

Playbooks

Integrations

Security & Administration

Roles

Permissions by area

Identity & Organization

Test Assets

Connections

Evaluation & Results

Reference Data

Analytics & Insights

Notes

​Roles

​Permissions by area

​Identity & Organization

​Test Assets

​Connections

​Evaluation & Results

​Reference Data

​Analytics & Insights

​Notes

Roles

Permissions by area

Identity & Organization

Test Assets

Connections

Evaluation & Results

Reference Data

Analytics & Insights

Notes