> ## Documentation Index > Fetch the complete documentation index at: https://docs.galtea.ai/llms.txt > Use this file to discover all available pages before exploring further. # Roles & Permissions > What each organization role can do on the Galtea platform Galtea uses role-based access control. Every member of your organization has one role that decides what they can see and change. This page lists the four organization roles and the actions each one can perform. Actions cover the standard operations (Create, Read, Update, Delete) plus a soft delete (a logical delete that hides a record without removing it). Many permissions are conditional, shown as a short rule in the cell. ## Roles * **OWNER**: Manages users and resources in their own organization. Cannot hard-delete. * **MEMBER**: Day-to-day access in their organization: view and contribute, with limited edits. Cannot hard-delete. * **HUMAN\_EVALUATOR**: Read-only across the organization, plus may annotate AI metrics and submit human evaluations. * **READER**: Read-only across the organization. Cannot create, update, or delete anything. Each cell shows what a role can do for that action. ✅ means allowed and ❌ means not allowed. A short rule (for example, "If product in own org") means the action is allowed only when that rule is true at the time, checked against your organization and the record's ownership. ## Permissions by area ### Identity & Organization **User** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------------------------------ | -------------------- | -------------------- | -------------------- | | Create | If target in own org | ❌ | ❌ | ❌ | | Read | If target in own org | If target in own org | If target in own org | If target in own org | | Update | If target in own org | Only self | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If target in own org, not self, and not an admin | ❌ | ❌ | ❌ | **Organization** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------- | ------- | ---------------- | ------- | | Create | ❌ | ❌ | ❌ | ❌ | | Read | Own org | Own org | Own org | Own org | | Update | ✅ | ❌ | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | ❌ | ❌ | ❌ | ❌ | ### Test Assets **Product** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | --------------------- | -------------------------------- | --------------------- | --------------------- | | Create | If product in own org | If product in own org | ❌ | ❌ | | Read | If product in own org | If product in own org | If product in own org | If product in own org | | Update | If product in own org | If product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If product in own org | If product is theirs (by userId) | ❌ | ❌ | **Version** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | | Create | If parent product in own org | If parent product in own org | ❌ | ❌ | | Read | If parent product in own org | If parent product in own org | If parent product in own org | If parent product in own org | | Update | If parent product in own org | If parent product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent product in own org | If parent product in own org | ❌ | ❌ | **Test** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ----------------------------------------------- | ----------------------------------------------- | ----------------------------------------------- | ----------------------------------------------- | | Create | If parent product in own org | If parent product in own org | ❌ | ❌ | | Read | If parent product in own org, or test is global | If parent product in own org, or test is global | If parent product in own org, or test is global | If parent product in own org, or test is global | | Update | If parent product in own org | If parent product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent product in own org | If parent product in own org | ❌ | ❌ | **Test Case** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | -------------------------------------------- | -------------------------------------------- | -------------------------------------------- | -------------------------------------------- | | Create | If parent test in own org | If parent test in own org | ❌ | ❌ | | Read | If parent test in own org, or test is global | If parent test in own org, or test is global | If parent test in own org, or test is global | If parent test in own org, or test is global | | Update | If parent test in own org | If parent test in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent test in own org | If parent test in own org | ❌ | ❌ | ### Evaluation & Results **Evaluation** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ------------------ | ---------------------------------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | | Create | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Read | If evaluation's product in own org | If evaluation's product in own org | If evaluation's product in own org | If evaluation's product in own org | | Update | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Annotate AI metric | ✅ | ✅ | ✅ | ❌ | | Human evaluation | ✅ | ✅ | ✅ | ❌ | *Annotating or submitting human evaluations also requires membership in the relevant User Group; the table shows the role-level gate only.* **Inference Result** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------------ | ------------------------------ | ------------------------------ | ------------------------------ | | Create | If result's product in own org | If result's product in own org | ❌ | ❌ | | Read | If result's product in own org | If result's product in own org | If result's product in own org | If result's product in own org | | Update | If result's product in own org | If result's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If result's product in own org | If result's product in own org | ❌ | ❌ | ### Reference Data **Metric** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------ | ------------------------ | ------------------------ | ------------------------ | | Create | If metric in own org | If metric in own org | ❌ | ❌ | | Read | If in own org, or global | If in own org, or global | If in own org, or global | If in own org, or global | | Update | If metric in own org | If metric in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If metric in own org | If metric in own org | ❌ | ❌ | **Model** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------ | ------------------------ | ------------------------ | ------------------------ | | Create | If model in own org | If model in own org | ❌ | ❌ | | Read | If in own org, or global | If in own org, or global | If in own org, or global | If in own org, or global | | Update | If model in own org | If model in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If model in own org | If model in own org | ❌ | ❌ | ### Analytics & Insights **Analytics** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ------ | ------------------ | ------------------ | ------------------ | ------------------ | | Read | If data in own org | If data in own org | If data in own org | If data in own org | ## Notes * **Read-only roles**: READER and HUMAN\_EVALUATOR can read exactly what a MEMBER can read (the same organization scope). They cannot create, update, or delete. HUMAN\_EVALUATOR additionally may annotate AI metrics and submit human evaluations; READER cannot. * **Organization scope**: "In own org" means the record (or its parent, such as a Product) has an organizationId equal to the signed-in user's organization. This keeps each client organization's data separate. * **Parent scope**: For nested records (Version, Test, Evaluation, and so on) access is derived from the parent's organization. Example: a Version belongs to a Product, and the Product belongs to an Organization. An Evaluation is reached through session to version to product. * **Global records**: Some records (Metric, Model, and a Test with no product) can be global, meaning not tied to one organization. Global records are readable by every role in addition to their own organization's records. * **Hard delete**: None of these roles can permanently delete records. Where deletion is shown it is a soft delete: the record is hidden, not removed.