Roles and permissions reference
This page lists the roles of Orbit and, for each action, which roles may do it.
This page is generated from the product code; do not edit by hand.
Project roles
Section titled “Project roles”A person gets a role on a project through a team. With several teams, the highest role on the project counts. The roles are listed from least to most: each role may do everything the roles before it may do.
| Role | In short |
|---|---|
| Viewer | Reads results and reports in a project; changes nothing. |
| QA Engineer | Does the daily testing work: starts runs and triages failures. |
| QA Lead | Owns quality decisions: quarantine, releases, reports and Jira issues. |
| Project Admin | Runs the project: environments, secrets, workloads and its people. |
System roles
Section titled “System roles”| Role | In short |
|---|---|
| System Admin | May do every action in every project, and the system actions below. |
| Member | Every other account. What a member may do comes from their project roles. |
Project actions
Section titled “Project actions”The least role for each action on a project. “yes” means the role may do it.
| Action | Viewer | QA Engineer | QA Lead | Project Admin | System Admin | Notes |
|---|---|---|---|---|---|---|
View runs, results and reports (execution:view) |
yes | yes | yes | yes | yes | Reading AI diagnoses and investigations needs only this. |
Start runs (execution:run) |
no | yes | yes | yes | yes | On a restricted environment: project admins, or people with a run grant. |
Delete or restore their own runs (execution:invalidate-own) |
no | yes | yes | yes | yes | Deleted runs and results leave every list and figure; they can be restored for 30 days, then they are purged. |
Run an AI diagnosis (ai:diagnose) |
no | yes | yes | yes | yes | |
Create and change investigations (investigation:manage) |
no | yes | yes | yes | yes | |
Triage failures (test labels) (triage:manage) |
no | yes | yes | yes | yes | |
Delete or restore anyone’s runs (execution:invalidate-any) |
no | no | yes | yes | yes | |
Quarantine tests (quarantine:manage) |
no | no | yes | yes | yes | |
Create Jira issues (issue:create) |
no | no | yes | yes | yes | |
Override run profiles (profile-override:manage) |
no | no | yes | yes | yes | |
Manage releases, cycles, gates, decisions and risks (quality:manage) |
no | no | yes | yes | yes | |
Save report snapshots, schedules and share links (report:manage) |
no | no | yes | yes | yes | |
Manage environments and run grants (environment:manage) |
no | no | no | yes | yes | |
Manage secrets and variables (secret:manage) |
no | no | no | yes | yes | |
Manage workloads (workload:manage) |
no | no | no | yes | yes | |
Manage integrations (Jira, Teams) (integration:manage) |
no | no | no | yes | yes | |
Add and remove people on the project (member:manage) |
no | no | no | yes | yes | Up to your own role; accounts for new people expire. |
Reset test data of a project (data:reset) |
no | no | no | yes | yes | Runs leave every list and figure at once and are removed after 7 days; Purge now is for System Admins. |
Delete run artifacts (artifact:delete) |
no | no | no | yes | yes | |
Delete releases and cycles (quality:delete) |
no | no | no | yes | yes |
System actions
Section titled “System actions”Only a System Admin may do these, whatever their project roles.
| Action | Viewer | QA Engineer | QA Lead | Project Admin | System Admin | Notes |
|---|---|---|---|---|---|---|
Invite and manage users; read the audit log (user:manage) |
no | no | no | no | yes | |
Manage teams, projects and project roles (team:manage) |
no | no | no | no | yes | |
Enroll, revoke and configure Stations (station:manage) |
no | no | no | no | yes | |
Publish announcements (announcement:manage) |
no | no | no | no | yes |
- Restricted environments: on a restricted environment, only a Project Admin or a person with a run grant on that environment may start runs.
- Expired accounts: an account is read-only for 3 days after it expires. Only viewing works. After that, and for a deactivated account, nothing works.
- No role on a project: a Member without a role on a project does not see it.
- How to add people and change roles: People and roles.