Roles and Permissions
Understand the RBAC model in PlayableLabs with five organization roles, two team roles, and a detailed permission matrix
Overview
PlayableLabs uses role-based access control (RBAC) to manage what each team member can do within an organization. The system has two tiers:
- System Roles -- Platform-wide roles (User, Supervisor, System Admin)
- Organization Roles -- Per-organization roles that control access to games, assets, and settings
This page focuses on the five organization roles that you interact with daily. A separate pair of team roles (Lead and Member) applies inside a single team; see Team Roles.
The Five Roles
Owner
- Full control over the organization, including deletion
- Can transfer ownership to another member
- Cannot be removed (only transferred)
- One Owner per organization
Typical users: Founders, agency owners, studio heads
Admin
- Manage all games, assets, and organization members
- Configure organization settings
- Create and manage teams, and control which teams can open each game
- Cannot delete the organization
Typical users: CTOs, account managers, technical directors
Manager
- Create, edit, and delete games, versions, and variants
- Export playable ads
- Create, edit, and delete teams, manage team members and team roles, and control which teams can open each game
- Can always open every game, including games restricted to teams
- Cannot invite or remove organization members, change organization roles, or edit organization settings
Typical users: Product managers, creative directors, campaign managers
Member
- Create and edit games (may require approval)
- Upload and manage assets
- Create and edit variants
- Export playable ads
- Limited to assigned content visibility
- Can view teams, the access matrix, and team activity, but cannot create or change them
Typical users: Developers, designers, content creators
Viewer
- Read-only access to assigned games and assets
- Can view and download exports
- Cannot make any changes (teams are read-only too)
Typical users: Clients, stakeholders, investors, executives
Team Roles
A team role is separate from an organization role. It applies only inside one team and is shown on the team's Members panel.
| Team role | What it can do in its own team |
|---|---|
| Lead | Add members, remove Members, and leave the team |
| Member | Open the team's games. Cannot change the roster |
- A Lead manages only the team they lead. They cannot edit or delete the team, change its games, or set anyone's team role.
- A Lead cannot remove another Lead. Only an Owner, Admin, or Manager can.
- Only an Owner, Admin, or Manager can make someone a Lead or a Member.
- A team role does not change what a person can do elsewhere in the organization.
See Team Management for how teams, the access matrix, and game access work.
Permission Matrix
| Action | Owner | Admin | Manager | Member | Viewer |
|---|---|---|---|---|---|
| Organization | |||||
| Delete organization | Yes | No | No | No | No |
| Edit organization settings | Yes | Yes | No | No | No |
| View organization | Yes | Yes | Yes | Yes | Yes |
| Team Members | |||||
| Invite members | Yes | Yes | No | No | No |
| Remove members | Yes | Yes | No | No | No |
| Change roles | Yes | Yes | No | No | No |
| Teams | |||||
| View teams, access matrix, team activity | Yes | Yes | Yes | Yes | Yes |
| Create, edit, delete teams | Yes | Yes | Yes | No | No |
| Add or remove team members | Yes | Yes | Yes | Lead only† | Lead only† |
| Set team roles (Lead/Member) | Yes | Yes | Yes | No | No |
| Assign games to teams (access matrix) | Yes | Yes | Yes | No | No |
| Games | |||||
| Create games | Yes | Yes | Yes | Yes* | No |
| Edit all games | Yes | Yes | Yes | No | No |
| Edit assigned games | Yes | Yes | Yes | Yes | No |
| Delete games | Yes | Yes | Yes | No | No |
| View all games | Yes | Yes | Yes | No | No |
| View assigned games | Yes | Yes | Yes | Yes | Yes |
| Variants | |||||
| Create variants | Yes | Yes | Yes | Yes | No |
| Edit variants | Yes | Yes | Yes | Yes | No |
| Delete variants | Yes | Yes | Yes | No | No |
| Export variants | Yes | Yes | Yes | Yes | Yes |
| Assets | |||||
| Upload assets | Yes | Yes | Yes | Yes | No |
| Delete assets | Yes | Yes | Yes | No | No |
| View assets | Yes | Yes | Yes | Yes | Yes |
*Members can create games but may need approval depending on organization settings.
†Only for a team where the person holds the team role of Lead, and only in that team. A Lead can remove Members and themselves, never another Lead.
A game with no team is open to every organization member. Once a team is assigned, only members of the assigned teams, plus Owners, Admins, and Managers, can open it.
Role Hierarchy
Roles follow a strict hierarchy where higher roles inherit all permissions of lower roles:
Owner (5) > Admin (4) > Manager (3) > Member (2) > Viewer (1)This means an Admin automatically has every permission that a Manager, Member, and Viewer has.
Multi-Organization Support
Users can hold different roles in different organizations. For example, you might be an Owner of your own agency organization and a Viewer in a client's organization.
Your role is evaluated per-organization, and switching organizations via the organization selector updates your permissions accordingly.
Best Practices
- Least privilege -- Assign the minimum role required for each person's responsibilities
- Limit Owner and Admin roles -- Only essential personnel should have administrative access
- Use Manager for people who run teams -- Managers can create teams and control game access without organization settings or member invitations. For someone who only looks after one team's roster, make them that team's Lead and keep their organization role lower
- Viewer for external stakeholders -- Provide clients with read-only access instead of sharing exports manually
- Audit regularly -- Review role assignments periodically in the Members page
Next Steps
- Team Members -- Invite and manage your roster
- Team Management -- Teams, the access matrix, and game access