Account Roles and Permissions
Understand platform roles, organization roles, resource permissions, and visibility in UnieAI Studio.
UnieAI Studio uses three permission layers to determine which features a user can enter and which actions they can perform:
- Platform roles control administration, platform capabilities, and default quotas.
- Organization roles control permissions inside a specific organization workspace.
- Resource permissions control use and editing of a specific Customize Model, knowledge base, or skill.
Resource visibility is a separate access condition evaluated together with these roles and explicit grants.
Platform Roles
Platform roles apply to the entire account. The platform currently supports five roles:
| Platform role | Primary purpose |
|---|---|
| Super Admin | Highest platform-management role, with access to the admin panel and platform administration |
| Admin | Access to most platform-management features, including users, Model Zoo, platform settings, and Marketplace review |
| Pro | Non-admin role that uses the currently configured Pro capabilities and default quotas |
| User | Standard non-admin role that uses the currently configured User capabilities and default quotas |
| Pending | Restricted, not-yet-activated role that can sign in and browse some pages but cannot use the main creation and model features |
The first platform account created becomes a Super Admin. The first active Super Admin is protected from deactivation. The default role for later registrations is configurable and is not always User or Pending.
Super Admin and Admin
Super Admin and Admin share most day-to-day administration capabilities, including:
- Managing platform users and their platform roles
- Configuring role quota presets and per-user overrides
- Managing UnieAI Model Zoo and platform model settings
- Reviewing knowledge base and skill Marketplace submissions
- Viewing platform usage and managing platform settings
- Managing invitation and reward-related settings
Super Admin represents the highest management tier and is used for platform bootstrap and account protection. The exact features shown still depend on the deployed edition and enabled modules.
Pro, User, and Role Quotas
Pro and User are standard non-admin roles. Their differences are primarily determined by the active role quota preset, such as:
- Whether organizations can be created
- The number of organizations a user can create
- Organization member and collaborator limits
- Total knowledge base storage and per-file limits
Administrators can change role presets and apply per-user overrides. Pro should therefore not be described as a permanently fixed feature bundle.
What Pending Can Do
Pending users can sign in and browse some workspace or model pages, but currently cannot:
- Adopt base models or use models
- Create Customize Models
- Create user API keys
- Create organizations
- Redeem gift codes or authorize CLI access
- Be assigned as organization or Customize Model members
An administrator must change the account to an active platform role, such as Pro or User, before the user can access capabilities allowed by that role and its quotas.
Organization Roles
Organization roles apply only inside an organization workspace. A Personal space belongs to one user and does not use organization member roles.
The Creator is the highest-permission organization member:
- Update the organization name and settings
- Invite or remove members and change member roles
- Use and manage organization resources
- Delete the organization in supported development environments
Each organization has one Creator.
A Collaborator can help manage the organization and its resources:
- Update the organization name
- Invite members
- Promote a User to Collaborator
- Remove Users
- Use and edit organization resources
A Collaborator cannot remove the Creator or demote or remove another Collaborator.
An organization User can use organization resources and manage resources they created:
- View and use accessible Customize Models, knowledge bases, and skills
- Edit resources they created inside the organization
- Cannot change organization settings, members, roles, or invitations
- Cannot edit resources created by someone else unless granted resource-level Collaborator access
Resource Permissions
Customize Models, knowledge bases, and skills can have their own assigned members. Resource permissions affect only that resource and do not change a user's platform or organization role.
| Resource permission | Allowed actions |
|---|---|
| Creator | Manage resource content, members, access settings, and deletion |
| Resource Collaborator | Edit the assigned resource; does not gain control over other resources or organization settings |
| User access | View or use the resource without editing its content |
For example, an organization User can be assigned as a Resource Collaborator on one knowledge base. They can edit that knowledge base but still cannot change organization settings or edit unrelated resources.
Resource Visibility
Visibility determines whether someone who is not explicitly assigned to the resource can still see or use it:
| Visibility | Meaning |
|---|---|
| Private | Accessible by the Creator by default, plus explicitly granted resource members |
| Group | Accessible to members of the organization workspace according to their permissions; available only to resources created in an organization workspace |
| Public | Viewable or usable by signed-in platform users who satisfy the relevant authentication requirements |
Permission to use a resource does not imply permission to edit it. Public, Group, and User access normally grant use; editing still requires Creator or Resource Collaborator permission.
How Permissions Are Combined
When a user opens or modifies a resource, the platform evaluates:
- Whether the account is active and the platform role allows the feature.
- Whether the current context is a Personal space or an organization workspace.
- The user's role in that organization.
- Any explicit Collaborator or User grant on the resource.
- The resource's visibility and other access settings.
A platform role does not automatically give a standard user ownership of every organization resource, and an organization role does not affect permissions in another organization.