Roles

Overview

Oblax uses a three-tier role system that spans platform, organization, and project levels. Each tier has its own set of roles with specific capabilities. Platform roles control access to the Oblax platform itself. Organization roles control access to organizations and their projects. Project roles control access to individual project settings and resources.

Roles are independent across tiers. A PLATFORM_ADMIN does not automatically become an organization owner or project admin. Each role must be explicitly assigned.

Platform Roles

Platform roles define a user’s access level within the Oblax platform. These roles are assigned by PLATFORM_SUPER_ADMIN users only.

Role	Capabilities
`PLATFORM_SUPER_ADMIN`	Unrestricted access to all platform features, users, organizations, billing, and security
`PLATFORM_ADMIN`	Operational access to manage and inspect organizations, projects, and users for support
`PLATFORM_USER`	Default role for all users. Access limited to explicitly assigned organizations and projects

New users are automatically assigned PLATFORM_USER on account creation. Platform roles do not inherit or imply organization or project roles.

Organization Roles

Organization roles define a user’s access level within an organization. These roles are assigned by ORG_OWNER or ORG_ADMIN users.

Role	Capabilities
`ORG_OWNER`	Full access to all projects and organization settings. Can manage billing and ownership
`ORG_ADMIN`	Access to all projects within the organization. Cannot change ownership or view billing
`ORG_MEMBER`	No default access. Must be assigned to a project by an owner or admin

Project Roles

Project roles define a user’s access level within a single project. These roles are assigned by PROJ_ADMIN users or by organization owners and admins.

Role	Capabilities
`PROJ_ADMIN`	Full access to project settings. Can manage project members
`PROJ_MEMBER`	Can view project settings. Cannot manage members

Role Assignment

Platform Roles

Only PLATFORM_SUPER_ADMIN can assign platform roles. Users cannot assign roles to themselves.

Organization and Project Roles

Organization and project roles are assigned by organization owners, organization admins, or project admins. The assignment is done through the CLI or web interface.

obx project invite user@example.com --role PROJ_MEMBER

Role Inheritance

The role system follows strict inheritance rules:

Rule	Description
Project creation	Only `ORG_OWNER` or `ORG_ADMIN` can create projects
Project creator	Automatically assigned `PROJ_ADMIN`
Project admin	Can invite and assign roles to other users
Platform independence	Platform roles do not imply org or project roles

Typical Use Cases

New User

User creates an Oblax account
System assigns PLATFORM_USER
System creates a default organization
System assigns ORG_OWNER for the new organization

New Project

ORG_OWNER or ORG_ADMIN creates a project
Creator is automatically assigned PROJ_ADMIN

Inviting a User (as ORG_OWNER or ORG_ADMIN)

PROJ_ADMIN with org-level role invites a user
Invited user is added to the organization as ORG_MEMBER
Invited user is added to the project as PROJ_MEMBER

Inviting a User (as ORG_MEMBER)

PROJ_ADMIN with ORG_MEMBER role invites a user
Invitation is sent to ORG_OWNER or ORG_ADMIN for approval
Once approved, user is added as ORG_MEMBER and PROJ_MEMBER

Role Assignment Matrix

Platform Roles

Role	Can assign `PLATFORM_SUPER_ADMIN`	Can assign `PLATFORM_ADMIN`	Can assign `PLATFORM_USER`
`PLATFORM_SUPER_ADMIN`	Yes	Yes	Yes
`PLATFORM_ADMIN`	No	No	No
`PLATFORM_USER`	No	No	No

Organization and Project Roles

Role	`ORG_OWNER`	`ORG_ADMIN`	`ORG_MEMBER`	`PROJ_ADMIN`	`PROJ_MEMBER`
`ORG_OWNER`	Yes	Yes	Yes	Yes	Yes
`ORG_ADMIN`	No	Yes	Yes	Yes	Yes
`ORG_MEMBER`	No	No	No	No	No
`PROJ_ADMIN`	No	No	No	Yes	Yes
`PROJ_MEMBER`	No	No	No	No	No

Where to next

Section	Description
ACL and Permissions	Use roles in ACL rules to control endpoint access
Realms	Combine roles with realms for fine-grained scoping
Authentication and Authorization	Understand how roles appear in JWT claims