Roles and Permissions

Prangana uses a two-tier RBAC model: account roles and organization roles. Account roles control platform-level access; organization roles control workspace-level access.

Managing roles

To invite users and assign roles, see Manage team access. To automate role assignment via directory groups, see Directory connections.

Account roles

Role	Description
SuperAdmin	Full control over the account, users, billing, and organizations
Member	Read-only access to account-level information

Account role permissions

Permission	SuperAdmin	Member
account.users.invite	Yes	No
account.users.manage	Yes	No
account.roles.manage	Yes	No
account.billing.manage	Yes	No
account.organizations.create	Yes	No
account.audit.view	Yes	No
account.view	Yes	Yes

warning

SuperAdmin grants full control over the account including the ability to delete organizations and remove users. Assign this role only to trusted administrators.

Organization roles

Role	Description
Owner	Full control over the organization, members, projects, and services
Admin	Can manage settings, projects, and services; can view members
Member	Can create and view projects and services

Organization role permissions

Permission	Owner	Admin	Member
org.members.manage	Yes	No	No
org.members.view	Yes	Yes	No
org.settings.manage	Yes	Yes	No
org.projects.manage	Yes	Yes	No
org.projects.view	Yes	Yes	Yes
org.projects.create	Yes	Yes	Yes
org.services.deploy	Yes	Yes	Yes
org.services.view	Yes	Yes	Yes
org.audit.view	Yes	Yes	No

Authorization context

When Nexus loads, it fetches the authorization context for the current user. This context contains:

• The user's identity (ID, email, display name)
• All accounts the user belongs to and their account role
• All organizations the user belongs to and their organization role
• A flat list of all effective permissions

The authorization context is used throughout Nexus to show or hide UI elements based on what the current user is allowed to do.

Example authorization context

{
  "user": {
    "id": "user-uuid",
    "email": "dev@example.com",
    "displayName": "Dev User"
  },
  "accounts": [
    {
      "accountId": "account-uuid",
      "accountName": "Acme Corp",
      "role": "SuperAdmin",
      "permissions": [
        "account.users.invite",
        "account.users.manage",
        "account.roles.manage",
        "account.billing.manage",
        "account.organizations.create",
        "account.audit.view",
        "account.view"
      ]
    }
  ],
  "organizations": [
    {
      "organizationId": "org-uuid",
      "accountId": "account-uuid",
      "organizationName": "Platform Team",
      "role": "Owner",
      "permissions": [
        "org.members.manage",
        "org.members.view",
        "org.settings.manage",
        "org.projects.manage",
        "org.projects.view",
        "org.projects.create",
        "org.services.deploy",
        "org.services.view",
        "org.audit.view"
      ]
    }
  ],
  "permissions": ["account.view", "org.projects.view"]
}

Permission checks in Nexus

Nexus checks permissions before enabling actions:

Action	Required permission
Invite a user	account.users.invite
Remove a user	account.users.manage
Change account role	account.roles.manage
View audit events	account.audit.view
Create a project	org.projects.manage
Delete a project	org.projects.manage
Provision a service	org.services.deploy
Delete a service	org.services.deploy
Manage org members	org.members.manage
View org members	org.members.view
Manage org settings	org.settings.manage

Plan-gated features

Some features are gated by your subscription plan in addition to role permissions:

Feature	Flag	Description
User invitations	inviteUsersFeatureEnabled	Required to invite users to the account
Directory integration	directoryIntegrationEnabled	Required to configure directory connections
Custom roles	customRolesEnabled	Required to define custom role templates

info

If a feature flag is false, the corresponding UI is disabled with an upgrade prompt even if the user has the required role. Contact hello@prangana.io to upgrade your plan.

Troubleshooting access issues

If you are seeing "Access denied" or disabled buttons, see Common issues — Access and permissions.