Skip to main content

Roles and permissions

Four roles, highest to lowest: owner, admin, member, guest.

:::note editor is gone Anyone still holding the old editor role is read as a member. :::

What each can do​

OwnerAdminMemberGuest
Read everything in the organization●●●●
Run tests assigned to them●●●●
Comment, report bugs●●●●
Create and edit content●●●
Turn a session bug into a comment, or a comment into a bug — a comment only its author, or an owner or admin●●●
Approve and reject visual changes●●●
Delete content●●
Administration (members, invites, tokens, integrations, policies, custom fields)●●
Their own and a colleague's content activity●●●●
The organization-wide activity log●●
Billing and subscription●
Export the organization's data●●
Download their own data●●●●
Delete the organization●

"Members cannot delete", and how it is enforced​

This is a rule about content, and it is enforced twice: the server refuses every DELETE from a member or guest, and the browser mirrors the same rule so the request is refused before it is sent, with a sentence rather than a 403 in the console.

Both copies have to agree. A rule in one and not the other is either a request the browser blocks that the server would have allowed, or the reverse.

The exemptions​

A small allow-list covers deletions that destroy nothing:

  • Clearing an unstable flag. A member who could raise the flag can lower it. Without this, a member could mark a test flaky and then be unable to unmark it, and because re-flagging an already-flagged test is treated as an edit, the visible symptom was the flag showing the date of the first mark forever.
  • Your own AI connector tokens. They are your credentials, not organization content.

Converting a session bug or comment​

Turning a session bug into a comment removes the bug, but it is an edit, not a deletion: the words, attachments and author move to the comment, and it can be turned back. So members can do it — for a bug, any member, as for editing one; for a comment, its author, or an owner or admin, as for editing one. Guests cannot.

Milestones​

Milestones follow the same shape as everything else in the table above, spelt out because "delete" is easy to read too broadly here: owners, admins and members can create a Milestone, edit it, close and reopen it, and assign or remove hunts, sessions and runs — all of that counts as edit. Deleting a Milestone is owner/admin only. Guests read. See Milestones.

Visual testing​

Owners, admins and members can approve and reject visual changes, one at a time or with Approve all. Approving replaces a baseline rather than deleting anything, so it is not held back to owners and admins. Guests can open Visual Testing and look at every comparison, but cannot approve or reject. See Visual testing.

Guests​

A guest — sometimes shown as a viewer — reads, comments, reports bugs, and runs what is assigned to them. Guests are counted separately from seats and are invited under a weekly allowance that grows with your seat count. See Plans and billing.

Changing somebody's role​

Administration → Members. Owners and admins can change roles. There is always at least one owner; the last one cannot be demoted.

What is not role-gated​

Watching things. Asking to be told about somebody else's activity is not a change, so anybody can watch a bug hunt, a session, a folder or an automated test regardless of role.