Skip to main content
Every member of an organization has one role. The role sets what the member can see and change. This page lists what each built-in role can do. It also covers custom roles, factory access and the audit log. To give a member a role, see Invite your team. To change one, see Manage members.

The built-in roles

Each role can do everything the role to its left can do. Every plan includes custom roles, factory access and single sign-on. The audit log and management API keys need an Enterprise plan. See Plans and limits. You cannot remove the last owner of an organization. Every active member is billed, whatever their role. See Billed members.

The Disabled role

A member with the Disabled role has no access and is not billed. The role menus in the dashboard do not offer it. You set it with the Organization API. To give a disabled member a role again, open Organization settings → Members. Then choose Re-enable in the member’s menu.

Custom roles

A custom role is a named set of permissions that you choose. Use one when no built-in role fits. Owners and admins create custom roles. A custom role can hold only permissions that you hold yourself. To create a custom role:
  1. Open the account menu at the bottom left, then choose Organization settings → Roles.
  2. Choose Create a role.
  3. Enter a Role name. Use letters, numbers and dashes, up to 100 characters.
  4. Enter a description of up to 500 characters in Description (optional), or leave it empty.
  5. Select the permissions the role needs. When a permission requires another one, the form selects that one too.
  6. Choose Create role.
The role then appears under Custom roles in the role menus of the invite dialog and the change-role dialog. To change a role, choose Edit role on its row, then Save changes. The change applies to every member who holds the role. To delete a role, choose Delete role and type the role’s name. If members hold the role, choose the role they get instead. The dialog warns you when that role gives permissions that the deleted role did not.

Factory access

A member holds their organization role on every factory. You can limit a member to the factories you choose, and give them a different role on each.
  1. Open the account menu at the bottom left, then choose Organization settings → Members.
  2. Choose the menu at the end of the member’s row, then Manage factory access.
  3. Turn on Restrict to specific factories.
  4. Turn on each factory the member needs.
  5. Choose the member’s role on each factory: Read, Write, Admin or a custom role.
Each change saves as you make it. The invite dialog has the same Restrict to specific factories switch. These rules apply:
  • A factory role replaces the member’s organization role on that factory. It does not add to it.
  • A restricted member sees only the factories you turn on. With none turned on, the member has no factory access.
  • An owner keeps the Owner role on every factory. You cannot restrict an owner.
  • Actions on the organization, such as inviting members, still follow the organization role.
To remove the limit, turn Restrict to specific factories off and choose Remove restriction. The member then holds the organization role on every factory again.

Audit log

The audit log records changes to access. These include invites, role changes, changes to factory access, API key changes and refused attempts. Nobody can edit or delete an entry. The audit log needs an Enterprise plan. The audit log also records each change to an automation, built in or custom. It records these events:
  • A member or an API key adds, changes or deletes an automation.
  • A member turns an automation on or off.
  • A member starts a run with Run now.
  • A member chooses File again for a topic.
An entry for a change holds the settings before the change and the settings after it. An entry for a deleted automation keeps its name. The audit log does not record a change that leaves every setting as it was. It does not record what OuterLayer does by itself, such as a switch-off after failed runs. It does not record a run that a schedule starts. It never holds a signing secret. Open Organization settings → Audit log to filter the entries by action and target, or choose Export CSV. To read the log from a script, see Audit log in the Organization API.

Next steps