> ## Documentation Index > Fetch the complete documentation index at: https://docs.galtea.ai/llms.txt > Use this file to discover all available pages before exploring further. # Roles & Permissions > What each organization role can do on the Galtea platform Galtea uses role-based access control. Every member of your organization has one role that decides what they can see and change. This page lists the four organization roles and the actions each one can perform. Actions cover the standard operations (Create, Read, Update, Delete) plus a soft delete (a logical delete that hides a record without removing it). Many permissions are conditional, shown as a short rule in the cell. ## Roles * **OWNER**: Manages users and resources in their own organization. Can permanently delete only Sessions and User Groups; every other entity is soft delete at most. * **MEMBER**: Day-to-day access in their organization: view and contribute, with limited edits. Can permanently delete only Sessions and User Groups; every other entity is soft delete at most. * **HUMAN\_EVALUATOR**: Read-only across the organization, plus may annotate AI metrics and submit human evaluations. * **READER**: Read-only across the organization. Cannot create, update, or delete anything. Each cell shows what a role can do for that action. ✅ means allowed and ❌ means not allowed. A short rule (for example, "If product in own org") means the action is allowed only when that rule is true at the time, checked against your organization and the record's ownership. ## Permissions by area ### Identity & Organization **User** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------------------------------ | -------------------- | -------------------- | -------------------- | | Create | If target in own org | ❌ | ❌ | ❌ | | Read | If target in own org | If target in own org | If target in own org | If target in own org | | Update | If target in own org | Only self | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If target in own org, not self, and not an admin | ❌ | ❌ | ❌ | **Organization** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------- | ------- | ---------------- | ------- | | Create | ❌ | ❌ | ❌ | ❌ | | Read | Own org | Own org | Own org | Own org | | Update | Own org | ❌ | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | ❌ | ❌ | ❌ | ❌ | **Subscription** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------------------------------- | ---------------------------------------------------- | ---------------- | ------- | | Create | ❌ | ❌ | ❌ | ❌ | | Read | Own org | Own org | Own org | Own org | | Update | If subscription in own org and billed through Stripe | If subscription in own org and billed through Stripe | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | ❌ | ❌ | ❌ | ❌ | **User Group** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------- | ------------------- | ------------------- | ------------------- | | Create | If group in own org | If group in own org | ❌ | ❌ | | Read | If group in own org | If group in own org | If group in own org | If group in own org | | Update | If group in own org | If group in own org | ❌ | ❌ | | Delete | If group in own org | If group in own org | ❌ | ❌ | | Soft delete | If group in own org | If group in own org | ❌ | ❌ | ### Test Assets **Product** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | --------------------- | -------------------------------- | --------------------- | --------------------- | | Create | If product in own org | If product in own org | ❌ | ❌ | | Read | If product in own org | If product in own org | If product in own org | If product in own org | | Update | If product in own org | If product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If product in own org | If product is theirs (by userId) | ❌ | ❌ | **Version** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | | Create | If parent product in own org | If parent product in own org | ❌ | ❌ | | Read | If parent product in own org | If parent product in own org | If parent product in own org | If parent product in own org | | Update | If parent product in own org | If parent product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent product in own org | If parent product in own org | ❌ | ❌ | **Dataset** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | -------------------------------------------------- | -------------------------------------------------- | -------------------------------------------------- | -------------------------------------------------- | | Create | If parent product in own org | If parent product in own org | ❌ | ❌ | | Read | If parent product in own org, or dataset is global | If parent product in own org, or dataset is global | If parent product in own org, or dataset is global | If parent product in own org, or dataset is global | | Update | If parent product in own org | If parent product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent product in own org | If parent product in own org | ❌ | ❌ | **Test Case** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | -------------------------------------------------- | -------------------------------------------------- | -------------------------------------------------- | -------------------------------------------------- | | Create | If parent dataset in own org | If parent dataset in own org | ❌ | ❌ | | Read | If parent dataset in own org, or dataset is global | If parent dataset in own org, or dataset is global | If parent dataset in own org, or dataset is global | If parent dataset in own org, or dataset is global | | Update | If parent dataset in own org | If parent dataset in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent dataset in own org | If parent dataset in own org | ❌ | ❌ | **Specification** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | | Create | If parent product in own org | If parent product in own org | ❌ | ❌ | | Read | If parent product in own org | If parent product in own org | If parent product in own org | If parent product in own org | | Update | If parent product in own org | If parent product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If parent product in own org | If parent product in own org | ❌ | ❌ | ### Connections **Endpoint Connection** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | | Create | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Read | If connection's product in own org | If connection's product in own org | If connection's product in own org | If connection's product in own org | | Update | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If connection's product in own org | If connection's product in own org | ❌ | ❌ | **Phone Connection** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | | Create | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Read | If connection's product in own org | If connection's product in own org | If connection's product in own org | If connection's product in own org | | Update | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If connection's product in own org | If connection's product in own org | ❌ | ❌ | **WebRTC Connection** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | | Create | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Read | If connection's product in own org | If connection's product in own org | If connection's product in own org | If connection's product in own org | | Update | If connection's product in own org | If connection's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If connection's product in own org | If connection's product in own org | ❌ | ❌ | ### Evaluation & Results **Session** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------------- | ------------------------------- | ------------------------------- | ------------------------------- | | Create | If session's product in own org | If session's product in own org | ❌ | ❌ | | Read | If session's product in own org | If session's product in own org | If session's product in own org | If session's product in own org | | Update | If session's product in own org | If session's product in own org | ❌ | ❌ | | Delete | If session's product in own org | If session's product in own org | ❌ | ❌ | | Soft delete | If session's product in own org | If session's product in own org | ❌ | ❌ | **Evaluation** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ------------------ | ---------------------------------- | ---------------------------------- | ---------------------------------- | ---------------------------------- | | Create | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Read | If evaluation's product in own org | If evaluation's product in own org | If evaluation's product in own org | If evaluation's product in own org | | Update | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If evaluation's product in own org | If evaluation's product in own org | ❌ | ❌ | | Annotate AI metric | ✅ | ✅ | ✅ | ❌ | | Human evaluation | ✅ | ✅ | ✅ | ❌ | *Annotating or submitting human evaluations also requires membership in the relevant User Group; the table shows the role-level gate only.* **Trace** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ----------------------------- | ----------------------------- | ----------------------------- | ----------------------------- | | Create | If trace's product in own org | If trace's product in own org | ❌ | ❌ | | Read | If trace's product in own org | If trace's product in own org | If trace's product in own org | If trace's product in own org | | Update | If trace's product in own org | If trace's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If trace's product in own org | If trace's product in own org | ❌ | ❌ | **Span** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ---------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | | Create | If span's product in own org | If span's product in own org | ❌ | ❌ | | Read | If span's product in own org | If span's product in own org | If span's product in own org | If span's product in own org | | Update | If span's product in own org | If span's product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If span's product in own org | If span's product in own org | ❌ | ❌ | **Comment** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ------ | ----- | ----------------------- | ---------------- | ------ | | Create | ✅ | ✅ | ❌ | ❌ | | Read | ✅ | ✅ | ✅ | ✅ | | Delete | ✅ | If the comment's author | ❌ | ❌ | *Free-form reviewer text on a trace. Access also requires the parent trace to be in your organization. Deleting is a soft delete; you may delete your own comments, and organization owners may delete any.* **Monitor** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | --------------------- | --------------------- | --------------------- | --------------------- | | Create | If product in own org | If product in own org | ❌ | ❌ | | Read | If product in own org | If product in own org | If product in own org | If product in own org | | Update | If product in own org | If product in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If product in own org | If product in own org | ❌ | ❌ | ### Reference Data **Metric** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------ | ------------------------ | ------------------------ | ------------------------ | | Create | If metric in own org | If metric in own org | ❌ | ❌ | | Read | If in own org, or global | If in own org, or global | If in own org, or global | If in own org, or global | | Update | If metric in own org | If metric in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If metric in own org | If metric in own org | ❌ | ❌ | **Model** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ----------- | ------------------------ | ------------------------ | ------------------------ | ------------------------ | | Create | If model in own org | If model in own org | ❌ | ❌ | | Read | If in own org, or global | If in own org, or global | If in own org, or global | If in own org, or global | | Update | If model in own org | If model in own org | ❌ | ❌ | | Delete | ❌ | ❌ | ❌ | ❌ | | Soft delete | If model in own org | If model in own org | ❌ | ❌ | ### Analytics & Insights **Analytics** | Action | OWNER | MEMBER | HUMAN\_EVALUATOR | READER | | ------ | ------------------ | ------------------ | ------------------ | ------------------ | | Read | If data in own org | If data in own org | If data in own org | If data in own org | ## Notes * **Read-only roles**: READER and HUMAN\_EVALUATOR can read exactly what a MEMBER can read (the same organization scope). They cannot create, update, or delete. HUMAN\_EVALUATOR additionally may annotate AI metrics and submit human evaluations; READER cannot. * **Organization scope**: "In own org" means the record (or its parent, such as a Product) has an organizationId equal to the signed-in user's organization. This keeps each client organization's data separate. * **Parent scope**: For nested records (Version, Dataset, Evaluation, and so on) access is derived from the parent's organization. Example: a Version belongs to a Product, and the Product belongs to an Organization. An Evaluation is reached through session to version to product. * **Global records**: Some records (Metric, Model, and a Dataset with no product) can be global, meaning not tied to one organization. Global records are readable by every role in addition to their own organization's records. * **Hard delete**: Each entity table has two delete rows. **Soft delete** hides a record without removing it. **Delete** is a permanent removal, shown as allowed only for Session and User Group (OWNER and MEMBER, within their own organization); for every other entity it is denied to all roles listed here.