Roles and permissions
Workspace and project roles in Skopo and what each one can do.
Skopo uses an owner-led access model. Every workspace member holds one workspace role, and every project team member holds one project role. Authorization is enforced server-side on every request — client-side controls that appear disabled reflect the same checks, they are not the sole line of defense.
Workspace roles
Workspace roles govern what a person can do across the workspace as a whole.
Owner
Can manage workspace settings, members, integrations, methodologies, and every project in this workspace.
Owners are the only role that can:
- Invite or remove workspace members and change member roles
- Configure methodology templates and switch a project's active methodology
- Create, archive, or delete projects (project lifecycle management)
- Manage workspace integrations and MCP tokens
- Access all projects in the workspace without being added to individual project teams
A workspace must always have at least one owner.
Member
Keeps access to this workspace, but only sees projects where they are explicitly added to the project team.
Members cannot manage workspace settings, membership, integrations, or methodologies. What they can do within a project depends on their project role.
Project roles
Within a project, each team member is assigned a project role that determines what they can do inside that project.
Lead
Can manage project settings, the project team, and project work.
Leads can change project settings, add or remove project team members, adjust team members' project roles, and perform all work-item actions available to members.
Member
Can create, edit, move, and comment on project work.
Members can create and update work items, move cards on the board, and participate in project rituals. They cannot manage project settings or the team roster.
Observer
Can read and comment on project work.
Observers have read access to the project and can add comments, but cannot create, edit, or move work items.
Access model summary
| Action | Owner | Project Lead | Project Member | Observer |
|---|---|---|---|---|
| Manage workspace settings & members | Yes | — | — | — |
| Manage integrations & MCP tokens | Yes | — | — | — |
| Manage methodology templates | Yes | — | — | — |
| Switch project methodology | Yes | — | — | — |
| Create / archive / delete projects | Yes | — | — | — |
| View all workspace projects | Yes | — | — | — |
| Manage project settings & team | Yes | Yes | — | — |
| Create, edit, move work items | Yes | Yes | Yes | — |
| Comment on work items | Yes | Yes | Yes | Yes |
| Read project content | Yes | Yes | Yes | Yes |
A workspace Owner also acts as a project Lead for every project in the workspace, regardless of whether they are on the project team.
A note on additional role values
The system's database defines additional role values (admin, methodology_author, methodology_publisher) that are not yet active permission tiers. At runtime, every workspace member whose role is not owner is treated as a standard Member — these additional values carry no distinct capabilities in the current version of Skopo.
For more on how roles interact with specific views and actions, see /docs/concepts/workflows-and-boards and /docs/guides/manage-your-team.