Permissions reference
Whenever you build a custom role, you choose a scope and then select the permissions it grants within that scope. Each permission is a single on/off switch: turning it on gives full use of that capability. There's no separate view-only version of a permission to grant on its own.
Workspace-scoped permissionsClick to copy link
| Category | Permission | What it grants |
|---|---|---|
| General | Modify workspace settings | Edit workspace name and settings. |
| General | Create new projects | Create new projects in the workspace. |
| Plan and billing | Manage plan and billing | View invoices, change product plans, add-ons, and billing info. |
| Collaboration | Manage collaboration settings | Invite and remove members, manage groups, and assign roles and permissions. |
| Security | Manage SSO settings | Configure SAML single sign-on for the workspace. |
| Security | Manage third-party integrations | Connect and manage third-party integrations. |
| Self-hosted infrastructure | Manage infrastructure | Manage self-hosted runner pools and Bitrise on AWS controllers and machine pools. |
| API access | Manage API access | View and manage workspace API tokens (WAT, OIDC). |
Bitrise CI-scoped permissionsClick to copy link
| Category | Permission | What it grants |
|---|---|---|
| Builds | View build logs | Read build output and step logs. |
| Builds | Run builds | Start new builds and rebuild existing ones. |
| Builds | Approve build requests | Approve individual pull request builds waiting for manual approval. Enabling manual approval requires the Edit workflows permission. If manual approval is enabled, Approve build requests is enough to approve builds. Today implicit to Admin and Owner. See Approving pull request builds. |
| Builds | Rebuild with remote access | Start builds with SSH remote access. |
| Workflows | View configuration YAML | View and export the project configuration file. |
| Workflows | Edit workflows | Edit an app's bitrise.yml, secrets, code signing, project settings, and webhooks. Broader than workflow configuration alone. |
| Build Cache | Manage project build cache | Configure and clear project build cache. |
Which built-in system roles have these by defaultClick to copy link
A quick-reference matrix: rows are permissions, columns are the roles that exist today. Custom roles pick and choose from these same rows: a checkmark below just means "granted by default," not "exclusive to."
Workspace scopeClick to copy link
| Permission | Owner | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Modify workspace settings | ✓ | ✓ | — | — |
| Create new projects | ✓ | ✓ | ✓ | — |
| Manage plan and billing | ✓ | — | — | — |
| Manage collaboration settings | ✓ | ✓ | — | — |
| Manage SSO settings | ✓ | ✓ | — | — |
| Manage third-party integrations | ✓ | ✓ | — | — |
| Manage infrastructure | ✓ | — | — | — |
| Manage API access | ✓ | ✓ | — | — |
Bitrise CI scopeClick to copy link
| Permission | Admin | Platform Engineer | Developer | Tester/QA |
|---|---|---|---|---|
| View build logs | ✓ | ✓ | ✓ | — |
| Run builds | ✓ | ✓ | ✓ | — |
| Approve build requests | ✓ | — | — | — |
| Rebuild with remote access | ✓ | ✓ | ✓ | — |
| View configuration YAML | ✓ | ✓ | — | — |
| Edit workflows | ✓ | ✓ | — | — |
| Manage project build cache | ✓ | ✓ | ✓ | — |
note
A workspace Owner also has every Bitrise CI-scoped permission on every project in the workspace, since the Owner role includes full access to all projects. The Bitrise CI matrix above compares only the four project-level roles.