> For the complete documentation index, see [llms.txt](https://docs.duku.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duku.ai/roles-and-permissions/overview.md).

# Overview

Duku uses role-based access control at the organisation level.

### Roles

| Role       | Description                                                                                                            |
| ---------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Member** | Can view products, targets, runs, graphs, screenshots, and test results. Can also start explorations and intent tests. |
| **Admin**  | Includes all Member capabilities, plus member management, API key management, and organisation settings.               |

New users get the **Member** role by default. Admins can change roles from **Settings → Members**.

### Permission matrix

| Capability                        | Member | Admin |
| --------------------------------- | :----: | :---: |
| View products, targets, and runs  |    ✅   |   ✅   |
| View state graphs and screenshots |    ✅   |   ✅   |
| Start explorations                |    ✅   |   ✅   |
| Start intent tests                |    ✅   |   ✅   |
| View errors and test results      |    ✅   |   ✅   |
| Generate API keys                 |        |   ✅   |
| Rotate and revoke API keys        |        |   ✅   |
| Invite members                    |        |   ✅   |
| Remove members                    |        |   ✅   |
| Change member roles               |        |   ✅   |
| Update organisation settings      |        |   ✅   |

### API key permissions

API keys are scoped to the organisation that created them. They cannot cross organisation boundaries.