---
title: User management
slug: user-management
createdAt: 2026-02-24T04:18:43.454Z
---

# Roles & Permissions

Kubegrade uses organization‑level role-based access control (RBAC) to ensure that users have the appropriate access to features and settings.



## Organization Roles

| Role          | Description                                                                                 | Key capabilities                                                                                                             |
| ------------- | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Org Owner** | Primary administrative role for the organization. Automatically assigned after signing up.  | Full access to all settings, billing, user management (invite/remove), and organization-wide integrations.                   |
| **Org Admin** | Administrative role for day-to-day management.                                              | Can manage users (except Org Owners) and organization settings, but typically does not handle subscription-level ownership.  |
| **Org User**  | Standard member role for core product usage.                                                | Can access dashboards, clusters, and AI agents, but cannot access Organization Settings or manage other users.               |



## Permissions Summary

### Core product features

- **All roles** can:
  - View clusters and dashboards.
  - Use visualization tools.
  - Interact with AI agents.
  - Manage their own personal notification preferences.



### Administrative & organization settings

- **Org Owners and Org Admins** can:
  - Access the **Organization Settings** menu.
  - **Invite new users** to the organization via email.
  - Manage **user roles** (promote/demote members).
  - Configure **organization-wide integrations**, such as GitHub/Azure DevOps PATs and MCP server connections.
- **Org Users**:
  - Cannot access Organization Settings.
  - Cannot invite or manage other users.
  - Cannot configure organization-wide integrations.



### Integration ownership

- **Connection creators**
  Regardless of role, the user who creates a specific MCP connection or custom agent is considered its owner for notifications. They receive system alerts for that resource (for example, disconnection events or token expiration).