Skip to main content
Ultra Hub uses Role-Based Access Control (RBAC) to manage what users can do within your organization. Every user is assigned a role that determines their permissions across the Ultra Hub. Roles are ordered from broadest to narrowest access: Owner > Admin > Member > Viewer > Beacon. In practice, permissions are defined explicitly per role, so treat the matrix below as the source of truth for what each role can do.

​
Roles

​
Owner

Full organization control including billing, settings, and member management. The user who creates an organization is automatically assigned the Owner role. Owner is the only role that can delete the organization.
  • Full access to all organization, team, workspace, and device operations
  • Can manage members (invite, remove, change roles)
  • Can delete the organization
  • Can manage all teams and workspaces
  • Only Owners can promote other users to Owner

​
Admin

Can manage teams, workspaces, and members. Admins are your organization’s day-to-day managers who handle team structure and user onboarding.
  • Can view and update organization settings (cannot delete the org)
  • Can manage members: invite users, change roles (up to Admin), remove members
  • Can create, update, and delete teams and workspaces
  • Can manage devices (create, link, unlink, archive, delete)
  • Can view the Admin Log
  • Can configure guardrails and governance rules

​
Member

Can view and work within assigned teams and workspaces. Members are your standard users who interact with Ultra’s security features daily.
  • Read access to organization, team, and workspace information
  • Can create, register, and link owned devices to workspaces
  • Can update workspaces and manage their devices, but cannot delete a workspace. Governance posture and drift enforcement are gated separately (workspace:manage_guardrails and org:update), so a Member cannot change those two settings from inside workspace update
  • An organization-level Member role resolves for every workspace in the organization, not only workspaces they were individually added to
  • Can sync device data and send heartbeats
  • Cannot manage other users or modify organization or team settings
  • Cannot view privileged materials (e.g., Admin Log)

​
Viewer

Read-only access to assigned teams and workspaces. Viewers can observe MCP traffic and security data but cannot make changes.
  • Read-only access to organization, team, and workspace information
  • Can link their own devices, and sync a device they own
  • Cannot manage devices they do not own
  • Cannot manage users or modify any settings
  • Cannot view privileged materials (e.g., Admin Log)

​
Beacon

Device-only role for machines that report into Ultra without their user needing dashboard access. Beacon users have zero dashboard access and exist for device linking and sync.
  • Exists to link a device and sync its data (traces, heartbeat)
  • No dashboard access
  • No direct access to organization, team, or workspace pages in the Hub
An Owner or Admin adds a beacon from Settings > Members using the + menu, and Ultra sends the person nothing. The role limits dashboard access, not linking: a beacon signs in and links their own device like anyone else, or you pair it with a deploy key so their device links itself on first start. Raise a beacon to a higher role any time from the role dropdown on their row. See Rolling Out to Your Team.

​
Permissions Matrix

Configure alerts is about changing the configuration, not reaching it. Alerts and its Configuration view are both gated on the view permission, so a Member or Viewer can open Configuration and see the current switch states. Only an Owner or Admin can change them.
Create is ✅ for every role because a new device is always self-owned. When a person registers or links a device interactively, the call requires only workspace:link_gateway, which every role holds, and the device’s owner is set to the user who created it. Linking with a deploy key is a different path: the key carries its own workspace and authorizes the link itself, so no role check runs and the owner comes from the key rather than from a calling user. There is no pre-existing device for a role check to resolve against, so create does not go through the owner fast-path that the rows below do.The link and sync rows are owner-scoped. Ultra resolves device access by an owner check first and the workspace role second, so any role can act on a device it owns through the owner fast-path, even where the role itself does not carry the permission. This holds for unlink, archive, and delete too: a Member who owns a device can delete it, and so can an owner with no workspace membership at all.The unlink/archive and delete rows describe devices owned by someone else, which is where the role is what decides, and why those rows stop at Admin.

​
Scope Hierarchy

Permissions are enforced at three entity levels, and roles cascade downward: Organization level: Controls org-wide settings, member management, and billing. Team level: Controls team membership and workspace management within a team. Workspace level: Controls device registration, linking, and MCP traffic visibility. A user’s role at the organization level automatically applies to all teams and workspaces within that organization. For example, an Org Admin has Admin permissions across all teams and workspaces without needing separate role assignments at each level.

​
Managing Roles

​
Via Hub Web UI

Navigate to your organization’s Members page in the Ultra Hub. Owners and Admins can change a member’s role using the role dropdown next to each member. Role changes take effect immediately. Important constraints:
  • Only Owners can assign or remove the Owner role
  • Admins can assign roles up to Admin (not Owner)
  • You cannot change your own role
  • The last Owner of an organization cannot be demoted or removed

​
Via Invitations

When inviting a new member, select the role they should receive. The invited user will be assigned that role upon accepting the invitation. Roles available for invitation depend on the inviter’s own role:
  • Owners can invite at any role level
  • Admins can invite at Admin level or below

​
Default Role Assignment

New users who join via invitation receive the role specified in the invitation. Users who create a new organization are automatically assigned the Owner role. For security, Ultra does not allow self-registration to an existing organization without an invitation. This prevents unauthorized users from gaining access.