User roles and permissions
Workspace roles
- Member — actively works in Starhive.
- Admin — manages the workspace, including users and permissions.
- Owner — created the workspace, or had ownership transferred to them. Exactly one per workspace; only the owner can delete the workspace.
- External — a restricted role for users outside your organization (e.g. guests provisioned via SSO/SCIM from a partner IdP); scoped down from a regular Member.
| Action | Member | Admin | Owner | External |
|---|---|---|---|---|
| Create workspace | ✓ | ✓ | ✓ | — |
| Create and manage spaces and objects | ✓ | ✓ | ✓ | limited |
| Access all public spaces | ✓ | ✓ | ✓ | limited |
| Manage workflows | see Workflows Management permissions | same | same | — |
| Manage automations | see Automation permissions | same | same | — |
| Invite users to the workspace | — | ✓ | ✓ | — |
| Remove users from the workspace | — | ✓ | ✓ | — |
| Manage workspace permissions | — | ✓ | ✓ | — |
| Manage subscription | — | — | ✓ | — |
| Transfer space ownership | — | — | ✓ | — |
| Transfer workspace ownership | — | — | ✓ | — |
| Delete workspace | — | — | ✓ | — |
Unverified
External is confirmed as a real role in the codebase (Identity.Role enum:
MEMBER, ADMIN, OWNER, EXTERNAL), but its exact permission boundaries above are our best inference,
not verified against a live workspace. If you administer external/guest users, confirm the specifics
in Workspace settings before relying on this table.
Space roles
| Action | Guest | Member | Admin | Owner |
|---|---|---|---|---|
| Manage the space | — | — | ✓ | ✓ |
| View space permissions | — | — | ✓ | ✓ |
| Edit space permissions | — | — | — | ✓ |
| Delete the space | — | — | — | ✓ |
| Create objects | — | ✓ | ✓ | ✓ |
| Update objects | — | ✓ | ✓ | ✓ |
| Delete objects | — | ✓ | ✓ | ✓ |
| CSV import | — | ✓ | ✓ | ✓ |
| View objects and related data | ✓ | ✓ | ✓ | ✓ |
See also Attribute permissions and User Groups for finer-grained access below the space level.