Teams & roles - CelerFlow

Every workspace is owned by a team. Teams are how CelerFlow shares connections, workflows, and runs between multiple users.

The four roles

Role	Level	What it means
Owner	4	Assigned automatically to the person who creates the team. Full control.
Admin	3	Can invite, remove members, and change roles.
Operator	2	Day-to-day workflow work — build, deploy, rerun, approve.
Viewer	1	Read-only access.

Roles are hierarchical: a higher role satisfies any check that requires a lower role. Role checks are enforced server-side on every team route — a client that tries to invite without at least the admin role gets a 403.

What each role can do

The role tiers and their hierarchy are enforced today in the backend. The in-product UI for team management is still in development — see Roadmap. You can already exercise roles via the team API endpoints.

Action	Minimum role
See teams you belong to	Viewer
View workflows and runs	Viewer
Build, deploy, and rerun workflows	Operator
Invite members	Admin
Remove members (other than yourself)	Admin
Change a member’s role	Admin
Transfer ownership or delete the team	Owner

Inviting members

An admin (or owner) issues an invite from the team API with the invitee’s email and a role. Once accepted, the new member appears in team_members with the assigned role. Everyone on the team automatically sees the team’s connections and workflows, subject to their role.

See also

Workspaces — how a workspace binds to a team.
Approvals — role scoping for pending confirmations.