Roles & permissions
What each role can do across the builder console. Truth lives in the effective-permissions view.
Permission matrix
Role changes happen on a member's detail page.
| Permission | Owner | Admin | Developer | Billing | Viewer |
|---|---|---|---|---|---|
| Manage account settings | Yes | Yes | — | — | — |
| Manage team members | Yes | Yes | — | — | — |
| Create SaaS products | Yes | Yes | Yes | — | — |
| Manage template packs | Yes | Yes | Yes | — | — |
| Deploy & provision | Yes | Yes | Yes | — | — |
| Manage billing | Yes | Yes | — | Yes | — |
| Manage marketplace store | Yes | Yes | — | — | — |
| Manage appliance packages | Yes | Yes | — | — | — |
| Purchase marketplace products | Yes | Yes | — | Yes | — |
| Install marketplace products | Yes | Yes | Yes | — | — |
| View marketplace revenue | Yes | Yes | — | Yes | — |
Maps builder-console permissions only. These roles authorize management of BuildWithHQ itself. Each provisioned SaaS has a separate tenant owner, user types, DataRoles, location scope, and record permissions inside its isolated core database.
Behind this page/team/roles · CanManageUsers
Retrieve
sp_Builder_ListRoles supplies the role set; vw_BuilderUserPermissions is the authoritative source of effective flags. Marketplace access is granular — CanManageMarketplaceStore, CanPurchaseMarketplace, CanInstallMarketplaceProducts, CanViewMarketplaceRevenue, CanManageMarketplacePayouts — enforced by fn_Marketplace_UserCan.Save
Role changes are saved from the member detail page viasp_Builder_UpdateUserRole; this matrix itself is read-only.Success
- Builder permissions come from the effective builder-permissions view and are rechecked server-side.
BuilderUserIdand tenantUserIdare different identities.- Tenant
DataRolesandDataRolesXrefnever grant builder-console access. - Owner overrides are explicit on each plane, never inferred across planes.
CLI handoff
Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.
Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.