> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> What owners, admins, billing admins, and members can do, and what API keys and app tokens can reach

Every member of a CostGraph organization has one role. The role decides what
they can change in the organization. Everyone can read the organization's
spend, usage, insights, and reports.

## Roles

CostGraph has four roles:

* **Owner**: full access, including single sign-on, deleting tenants, and
  deleting the organization. The person who creates the organization is its
  first owner.
* **Admin**: full access to the organization's resources and members, except
  the owner-only settings.
* **Billing admin**: manages the subscription and connects billing sources.
* **Member**: uses the product day to day: reads spend and creates budgets,
  reports, virtual tags, and workflows.

An organization always keeps at least one owner. To transfer ownership, give
another person the **Owner** role, then change your own.

## What each role can do

The following table lists what each role can do.

| Action | Owner | Admin | Billing admin | Member |
| - | - | - | - | - |
| Read spend, insights, Kubernetes, and VM data | Yes | Yes | Yes | Yes |
| Create budgets, reports, virtual tags, and workflows | Yes | Yes | Yes | Yes |
| Approve a workflow step | Yes | Yes | Yes | Yes |
| Create and manage your own API keys | Yes | Yes | Yes | Yes |
| Connect clouds, billing sources, and integrations | Yes | Yes | Yes | No |
| Set up billing exports | Yes | Yes | Yes | No |
| Manage the subscription and payment method | Yes | No | Yes | No |
| Connect ticketing tools and install Slack | Yes | Yes | No | No |
| Manage alert destinations | Yes | Yes | No | No |
| Invite members and change their roles | Yes | Yes | No | No |
| Manage other people's API keys and OAuth apps | Yes | Yes | No | No |
| Read the [audit log](/costgraph/security/audit-log) | Yes | Yes | No | No |
| Set up [SSO](/costgraph/security/sso) and [SCIM](/costgraph/security/scim) | Yes | No | No | No |
| Grant the **Owner** role | Yes | No | No | No |
| Delete a tenant or the organization | Yes | No | No | No |

When a workflow step runs, CostGraph checks the role of the person who started
the run, so a workflow can't do more than its creator can.

## Assign roles

You assign a role when you invite someone, and change it later under the
organization's members settings. Only an owner can invite or promote someone to
**Owner**.

With [single sign-on](/costgraph/security/sso#roles-from-groups) or
[SCIM](/costgraph/security/scim), your identity provider groups can grant
**Member**, **Admin**, or **Billing admin**. Neither changes an owner's role.
People who join through auto-join get **Member**.

## API keys

An API key belongs to the person who created it and to one tenant. It acts
with its owner's current role, limited to the scopes you give it. If the
owner's role changes, the key's access changes with it.

The following table lists the scopes you can give a key.

| Scope | Allows |
| - | - |
| `focus:read` | Read cost, forecast, commitments, unit economics, and allocation coverage |
| `focus:write` | [Push your own cost data](/costgraph/integrations/focus-push) |
| `budgets:read` | List budgets and read their spend |
| `budgets:write` | Create, update, and delete budgets |
| `usage:read` | Read resource usage, recommendations, anomalies, and the context graph |
| `integrations:read` | Read live data from connected services, such as quotas, limits, and settings |
| `pricing:read` | List your organization's prices |
| `pricing:write` | Assign prices to resources. Owners and admins only |
| `agent:read`, `agent:write` | Used by the [CostGraph Agent](/costgraph/agent) |
| `operator:read`, `operator:write` | Used by the [CostGraph Operator](/costgraph/operator/overview) |

Some endpoints need both a scope and a role. For example, reading your
CostGraph usage needs `focus:read` on a key whose owner is an owner or billing
admin.

API keys can't manage members, single sign-on, alert destinations, or the
audit log. Those need a signed-in person.

## App tokens

An app that uses [Sign in with CostGraph](/costgraph/developers/sign-in-with-costgraph)
acts as the person who approved it, with their role, in one tenant. It's
limited to the scopes they approved. App tokens can't manage API keys, connected apps,
OAuth apps, single sign-on, alert destinations, or Slack, and can't approve
workflow steps.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.