Roles and permissions

TIR uses role-based access control at two levels. The Admin role works at the account level and reaches every project. The project-level roles, Project Manager, Project Lead, and Member, apply to the projects a user is assigned to. Permissions pass downward: a role can add users only below its own level.

How the roles fit together

Diagram as text

flowchart TD
    O["Owner"] --> A["Admin"]
    O --> U["User"]
    U --> PM["Project Manager"]
    U --> PL["Project Lead"]
    U --> M["Member"]

The Owner sits at the top of the account. Below the Owner, every other person is either an Admin or a User, the two choices under Account role when you add someone. An Admin works at the account level and reaches every project, so project roles apply only to Users. A User is given one or more projects, with a project role in each: Project Manager, Project Lead, or Member.

The roles

Admin

The Admin role works at the account level, with visibility and control across all projects, users, and resources.

• Full access to every project in the account.
• Can create and manage projects.
• Can invite users and assign roles, except the Admin role.
• Can add, update, or remove members in any project, and manage resource access.
• Can change or remove users below the Admin level only; Admins and the Owner are outside an Admin’s control.

Project Manager

A Project Manager has full control over the assigned projects and can start new projects.

• Full access to all resources in assigned projects.
• Can create projects.
• Can add and manage members at the Project Lead or Member level only.
• Can assign and update policies for members, and manage project settings, including name and description.
• Works only in the projects assigned to them.

Project Lead

A Project Lead runs day-to-day work in a project: its resources, Members, policies, and settings.

• Full access to resources in the assigned project, and can use every service in it.
• Can invite and add users at the Member level only.
• Can assign and update policies for Members, and manage project settings.
• Works only in the assigned project. Creating projects is for a Project Manager, an Admin, or the Owner.

Member

The Member role is for contributors who need specific services. The policy you give a Member when you add them sets their access.

• Can use only the TIR services and actions the policy allows.
• Users, project settings, and membership are managed by the Project Lead and the roles above it.

Every Member needs a policy; see Policies.

Role permissions at a glance

Capability	Owner	Admin	Project Manager	Project Lead	Member
Access all projects	Yes	Yes	No	No	No
Create projects	Yes	Yes	Yes	No	No
Delete projects	Yes	Yes	Yes	No	No
Invite users to the account	Yes	Yes (below Admin)	Yes (Lead or Member)	Yes (Member)	No
Change or delete users on the IAM page	Yes	Yes (below Admin)	No	No	No
Change or remove project members	Yes	Yes	Yes (Lead or Member)	Yes (Member)	No
Manage project settings	Yes	Yes	Yes	Yes	No
Create and manage policies	Yes	Yes	Yes	Yes	No
Use project services	Yes	Yes	Yes	Yes	Yes (policy)