> For the complete documentation index, see [llms.txt](https://docs.duku.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duku.ai/roles-and-permissions/overview.md).

# Overview

Understand what Members and Admins can do.

Duku uses role-based access control at the organisation level.

### Roles

| Role                      | Description                                                                                                            |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Member** (`org-member`) | Can view products, targets, runs, graphs, screenshots, and test results. Can also start explorations and intent tests. |
| **Admin** (`org-admin`)   | Includes all Member capabilities, plus member management, API key management, and organisation settings.               |

New users get the **Member** role by default. Admins can change roles from **Settings → Members**.

### Permission matrix

| Capability                        |              Member             |              Admin              |
| --------------------------------- | :-----------------------------: | :-----------------------------: |
| View products, targets, and runs  | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| View state graphs and screenshots | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| Start explorations                | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| Start intent tests                | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| View errors and test results      | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| Change issue status and priority  | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| View the API key list             |                                 | <i class="fa-check">:check:</i> |
| Manage credential sets            | <i class="fa-check">:check:</i> | <i class="fa-check">:check:</i> |
| Generate API keys                 |                                 | <i class="fa-check">:check:</i> |
| Revoke API keys                   |                                 | <i class="fa-check">:check:</i> |
| Invite members                    |                                 | <i class="fa-check">:check:</i> |
| Remove members                    |                                 | <i class="fa-check">:check:</i> |
| Change member roles               |                                 | <i class="fa-check">:check:</i> |
| Update organisation settings      |                                 | <i class="fa-check">:check:</i> |

### API key permissions

API keys are scoped to the organisation that created them and cannot cross organisation boundaries. A key also inherits the roles of the user who created it, so a key created by an admin can perform admin operations. Create keys from a user whose role matches what the integration needs.