Understanding org roles: owner, admin, member, viewer

Understanding org roles: owner, admin, member, viewer

LandedFees ships four org roles: owner, admin, member, and viewer. Every role sits on a strict ladder (owner > admin > member > viewer) enforced server-side by the requireRole helper. A role's rank is checked on every mutating endpoint, so downgraded members cannot curl-through a POST or DELETE they should not be allowed to make.

The role a teammate joins with is set on the invite. Owners can change any role afterward from the team page.

Owner

The sole account holder. One owner per workspace, established at signup and transferable through the team page. Owner can do everything an admin can, plus manage billing (upgrade or downgrade the tier, add or remove seat add-ons), configure SSO on Business tier, and delete the workspace.

Admin

Everything a member can do, plus invite and revoke members, manage integrations, rotate or revoke API keys (which is separately gated behind LFQG-152), and run historical audit imports. Cannot touch billing or SSO.

Member

The regular contributor role. Can run calculations, upload entries for audit, generate PSC memos, share findings with a broker, open a support ticket, and comment on findings. Cannot invite teammates, cannot rotate API keys, cannot manage integrations. This is the right default for most teammates and most brokers.

The legacy reviewer role from the approvals workflow collapses to member-rank for RBAC purposes. Reviewers keep their approvals-specific privileges.

Viewer

Read-only. Can open every page in the workspace but every mutating action returns 403. Right role for auditors, finance colleagues who need read access, or an occasional external consultant.

Owner-or-self exception

A few team-management endpoints (like remove-member or downgrade-member) allow the caller to act on their own row without holding owner rank. So a member can remove themselves from a workspace without needing the owner to do it.

How the enforcement works

Server-side helpers requireRole(orgId, userId, minRole) and requireOwnerOrSelf(orgId, userId, targetUserId) gate every mutating endpoint. Both return typed results; the caller shapes the HTTP response and logs the denial with request context. Every write path in the dashboard, the calculator, the audit engine, and the API v1 surface calls one of these before touching data.

Frequently asked questions

Can I have more than one owner

No. Exactly one owner per workspace. Transfer the owner role to another admin from the team page.

What happens to the owner role if I leave

Transfer to another admin before you leave. Owner-less workspaces are a hard error and eventually get archived by the admin ops path.

Can I create a custom role

Not today. The four-role ladder is the enforcement primitive. Custom scopes are on the roadmap for the Business tier.

Does the API respect the same roles

Yes. API keys inherit the role of the user who created them. An admin's API key can rotate integrations; a member's API key cannot.