> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex-labs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Assign product roles and resource access

> Look up product access, Forge authoring, team grants and resource permissions separately.

Product access enables a kind of work. Resource access determines what you can do to a particular resource. Clearance is another required check.

## Account and product responsibilities

| Account or role | Purpose | Boundary |
| - | - | - |
| User | Holds product access and resource grants | Access can differ across resources. |
| Operator | Maintains the deployment | No customer-content access through the operator path. |
| Agent identity | Acts for a recorded caller | Delegation supplies no greater authority than its permitted session. |
| Arc | Personal chats and projects | Does not grant Vantage workspace authoring. |
| Vantage | Workspace work | Does not grant every workspace or dataset. |
| Forge author | Definition authoring | A separate flag. Admin status does not include it. Most kinds also need Vantage. |
| Admin | Console administration | Ordinary resource content still requires applicable access. |
| Security Officer | Clearance assignment and level lowering | The role does not grant source-content access. |
| Auditor | Permitted compliance inspection | Review access grants no editing authority. |

A person can hold several roles. Seats, product access, authoring and resource grants remain distinct.

## Resource access groups

| Operation | Reader | Contributor | Owner |
| - | - | - | - |
| Read | Yes | Yes | Yes |
| Create child or update | No | Yes | Yes |
| Delete or manage grants | No | No | Yes |
| Execute workflow | Subject to its effects | Subject to its effects | Subject to its effects |
| Execute ingestion job | No | Yes | Yes |
| Publish approved artefact | No | Yes | Yes |
| Withdraw publication | No | No | Yes |

Execution also checks dependencies, source reach, clearance and limits. A Reader cannot use a workflow to perform a write they lack authority to make.

Review requires the current assignment and subject access. No resource group alone supplies a review decision.

## Teams and defaults

Team Lead manages team membership. Member receives grants assigned to that team. Teams do not nest.

Direct and team grants combine to the person's highest applicable access group. To revoke access, inspect both routes.

The workspace creator receives Owner. The selected team receives its intended workspace grant; creation does not expose the workspace to every team.

A workspace reaching a dataset through a collection supplies Reader access to that dataset. Updates and ingestion need a Contributor grant on the dataset itself.

## Assign and verify

In Console, set the person's required product access and Forge-author flag. On the resource, grant the intended group directly or through a named team.

Check clearance before adding a member. After saving, inspect the person's effective access and one representative operation. Billing-team changes do not grant resource access.

Use [Manage workspace access and clearance](/administration/people-and-access/workspace-access-clearance) for the procedure and [Grant privileged authority and audit scope](/administration/people-and-access/privileged-authority) for privileged operations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.