Roles & Permissions
Access in ShardAnalytics is scoped to an organization. Every member has one of three roles, and permissions are checked per resource and per server.
| Role | Summary |
|---|---|
| Owner | Full control, including organization deletion and ownership transfer. At least one owner must exist. |
| Admin | Everything except deleting the organization or transferring ownership. Manages servers, settings, members, integrations, and API keys. |
| Member | Read-first access. Can create and manage their own dashboards, comparisons, and saved views, but cannot change organization configuration, secrets, or other members. |
What each role can do
Section titled “What each role can do”| Area | Owner | Admin | Member |
|---|---|---|---|
| Organization profile and settings | Yes | Yes | No |
| Members and invitations | Yes | Yes | No |
| Server create/update/delete | Yes | Yes | No |
| Server API keys and configuration | Yes | Yes | No |
| Payments and integrations | Yes | Yes | No |
| Campaigns | Yes | Yes | Read and analytics |
| Alerts and notifications | Yes | Yes | Read |
| Dashboards | Yes | Yes | Own boards |
| Audit log | Yes | Yes | No |
| Organization deletion / ownership transfer | Yes | No | No |
Invitations
Section titled “Invitations”Invite members from Organization Settings → Members:
- Enter the email address and choose a role.
- The invitation is recorded and the invitee receives a link.
- Pending invitations can be cancelled; accepted and rejected invitations are recorded in the audit log.
Members can leave an organization; owners and admins can remove members. Removing a member does not delete the data they created.
Scoping work to servers
Section titled “Scoping work to servers”Server access is permission-checked per server. When you invite staff who should only work on one server, give them a role and use server-level assignment where available. Campaign access can also be scoped to specific servers.
API keys
Section titled “API keys”Server API keys are managed separately from member roles. Anyone with the API key management permission can create, view masked values, and rotate keys for a server. Treat keys as secrets: rotate on staff changes and never share one key across servers.
Account settings
Section titled “Account settings”Your personal profile (display name, email, linked accounts, password) is separate from organization membership. Open Account from the user menu to manage it.