Roles

Zeotap includes three built-in roles and supports custom roles that workspace admins can create with any combination of permissions. Each member is assigned exactly one role, and that role determines their base permissions across all resource categories.

Role Summary

In addition to these three built-in roles, workspace admins can create custom roles tailored to specific team needs. See Custom Roles below.

Permission Comparison

The following table shows which capabilities each role has. See Permissions for the detailed permission-level breakdown.

Owner

The Owner role provides unrestricted access to every feature in the workspace. This is the only role that can:

• Delete the workspace — Permanently remove the workspace and all its data
• Transfer ownership — Assign the Owner role to another member
• Manage billing — View and modify billing settings and payment methods

Every workspace must have at least one Owner. If you attempt to remove the last Owner, the action will be denied.

When to use: Assign the Owner role to the person or service account responsible for the workspace’s lifecycle and billing. In most organizations, this is the workspace creator or a platform engineering lead.

Admin

The Admin role provides full access to all resources and settings except workspace-level management (deletion, ownership transfer). Admins can:

• Create and manage all infrastructure resources (warehouses, destinations)
• Configure governance settings (destination filters, access filters, groups)
• Manage workspace members (invite, change roles, remove)
• Create, modify, and delete custom roles
• Access all data without access filter restrictions
• Manage events, loaders, journeys, and identity graphs

When to use: Assign the Admin role to team leads, senior data engineers, or anyone who needs to configure the platform infrastructure. Admins are trusted to manage the full platform without the risk of accidentally deleting the workspace.

Member

The Member role provides read/write access to the day-to-day operational resources that analysts and marketers use most often:

• Can do: Create and manage models, syncs, audiences, and traits. View all resources. Trigger sync runs. View custom role definitions.
• Cannot do: Create or modify warehouses, destinations, identity graphs, journeys, events, loaders, governance settings, workspace settings, or custom roles. Cannot manage members or groups.

Members can see all data in the workspace (subject to access filter restrictions from their group membership). They simply cannot modify the underlying infrastructure.

When to use: Assign the Member role to analysts, marketers, growth engineers, and anyone who consumes the platform’s capabilities without needing to configure its infrastructure.

Custom Roles

In addition to the three built-in roles, workspace admins can create custom roles tailored to specific team needs. Custom roles have any subset of the available permissions — you choose exactly what a custom role can and cannot do.

Common Custom Role Examples

Creating a Custom Role

Via the UI

1. Navigate to Settings > Roles
2. Click Create Custom Role
3. Enter a name and description for the role
4. Select the permissions to include — permissions are grouped by category with checkboxes
5. Click Save

Via the API

curl -X POST https://your-workspace.zeotap.dev/api/v1/workspaces/{workspace_id}/roles \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Data Engineer",
    "description": "Manages warehouse infrastructure",
    "permissions": ["sources.read", "sources.write", "models.read", "models.write", "connections.read", "connections.write"]
  }'

Editing a Custom Role

Changes to a custom role’s permissions take effect immediately for all members assigned to that role.

1. Navigate to Settings > Roles
2. Find the custom role in the permission matrix
3. Toggle permissions on or off using the checkboxes
4. Changes are saved automatically

Deleting a Custom Role

When you delete a custom role, all members assigned to it are automatically reassigned to the Member built-in role. Groups referencing the deleted role have their role assignment cleared.

1. Navigate to Settings > Roles
2. Click the delete button on the custom role column
3. Confirm the deletion

Limitations

• Custom role names must be unique within the workspace
• Reserved names (owner, admin, member) cannot be used for custom roles
• Built-in roles cannot be modified or deleted
• Custom roles are workspace-scoped — they are not shared across workspaces

Changing a Member’s Role

Via the UI

1. Navigate to Settings > Members
2. Find the member in the list
3. Click the role dropdown next to their name
4. Select the new role
5. Confirm the change

Via the API

curl -X PUT https://your-workspace.zeotap.dev/api/v1/workspaces/{workspace_id}/members/{member_id}/role \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "role_id": "00000000-0000-0000-0000-000000000002"
  }'

You can use the role ID of any built-in or custom role. Built-in role IDs are stable and listed in the API Reference.

Who Can Change Roles

• Owners can change any member’s role, including promoting to Owner or demoting from Admin
• Admins can change a Member’s role to Admin, or an Admin’s role to Member. Admins cannot promote themselves to Owner or demote Owners.
• Members cannot change roles

Safeguards

• There must always be at least one Owner. You cannot demote the last Owner.
• Changing a role takes effect immediately. The member’s permissions update on their next API request or page navigation.
• Role changes are logged in the workspace audit trail.

Access Filter Exemption

By default, members with the Owner or Admin role are exempt from access filter filtering. They can see all data regardless of their group membership.

This behavior can be changed in Settings > Govern > Access Filter Settings by disabling “Exempt admins from access filters.” When disabled, Owners and Admins are subject to access filter filtering like Members.

Next Steps

• View the complete permission reference
• Create groups for team-based data access management
• Manage workspace members