Permissions reference
Whenever you build a custom role, you choose a scope and then select the permissions it grants within that scope. Each permission is a single on/off switch: turning it on gives full use of that capability. There's no separate view-only version of a permission to grant on its own.
Workspace-scoped permissionsClick to copy link
| Category | Permission | What it grants |
|---|---|---|
| General | Modify workspace settings | Edit workspace name and settings. |
| General | Create new projects | Create new projects in the workspace. |
| Plan and billing | Manage plan and billing | View invoices, change product plans, add-ons, and billing info. |
| Collaboration | Manage collaboration settings | Invite and remove members, manage groups, and assign roles and permissions. |
| Security | Manage SSO settings | Configure SAML single sign-on for the workspace. |
| Security | Manage third-party integrations | Connect and manage third-party integrations. |
| Self-hosted infrastructure | Manage infrastructure | Manage self-hosted runner pools and Bitrise on AWS controllers and machine pools. |
| API access | Manage API access | View and manage workspace API tokens (WAT, OIDC). |
Bitrise CI-scoped permissionsClick to copy link
| Category | Permission | What it grants |
|---|---|---|
| Builds | View build logs | Read build output and step logs. |
| Builds | Run builds | Start new builds and rebuild existing ones. |
| Builds | Approve build requests | Turn manual pull request build approval on or off, and approve individual pull request builds. Today implicit to Admin and Owner. See Approving pull request builds. |
| Builds | Rebuild with remote access | Start builds with SSH remote access. |
| Workflows | View workflows | See workflow names and configurations. |
| Workflows | View bitrise.yml | View and export the project configuration file. |
| Workflows | Edit workflows | Edit an app's bitrise.yml, secrets, code signing, project settings, and webhooks. Broader than workflow configuration alone. |
| Build Cache | Manage project build cache | Configure and clear project build cache. |
Which built-in system roles have these by defaultClick to copy link
A quick-reference matrix: rows are permissions, columns are the roles that exist today. Custom roles pick and choose from these same rows: a checkmark below just means "granted by default," not "exclusive to."
Workspace scopeClick to copy link
| Permission | Owner | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Modify workspace settings | ✓ | ✓ | — | — |
| Create new projects | ✓ | ✓ | ✓ | — |
| Manage plan and billing | ✓ | — | — | — |
| Manage collaboration settings | ✓ | ✓ | — | — |
| Manage SSO settings | ✓ | ✓ | — | — |
| Manage third-party integrations | ✓ | ✓ | — | — |
| Manage infrastructure | ✓ | — | — | — |
| Manage API access | ✓ | ✓ | — | — |
Bitrise CI scopeClick to copy link
| Permission | Admin | Platform Engineer | Developer | Tester/QA |
|---|---|---|---|---|
| View build logs | ✓ | ✓ | ✓ | — |
| Run builds | ✓ | ✓ | ✓ | — |
| Approve build requests | ✓ | — | — | — |
| Rebuild with remote access | ✓ | ✓ | ✓ | — |
| View workflows | ✓ | ✓ | ✓ | — |
View bitrise.yml | ✓ | ✓ | — | — |
| Edit workflows | ✓ | ✓ | — | — |
| Manage project build cache | ✓ | ✓ | ✓ | — |
注記
A workspace Owner also has every Bitrise CI-scoped permission on every project in the workspace, since the Owner role includes full access to all projects. The Bitrise CI matrix above compares only the four project-level roles.