> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alana.shopping/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> Role hierarchy and access control for workspace members.

## Role hierarchy

Alana Shopping uses a numeric role hierarchy. Higher numbers have more permissions, and every role inherits the capabilities of lower roles.

| Role       | Level | Description                                    |
| ---------- | ----- | ---------------------------------------------- |
| **Owner**  | 4     | Full control over the workspace                |
| **Admin**  | 3     | Manage members, billing, and configuration     |
| **Editor** | 2     | Create and modify content (products, catalogs) |
| **Viewer** | 1     | Read-only access to all resources              |

## Permission matrix

| Action                   | Owner | Admin | Editor | Viewer |
| ------------------------ | :---: | :---: | :----: | :----: |
| View workspace data      |  Yes  |  Yes  |   Yes  |   Yes  |
| Create/edit products     |  Yes  |  Yes  |   Yes  |   No   |
| Create/edit catalogs     |  Yes  |  Yes  |   Yes  |   No   |
| Publish catalogs         |  Yes  |  Yes  |   No   |   No   |
| Manage brands            |  Yes  |  Yes  |   No   |   No   |
| Invite members           |  Yes  |  Yes  |   No   |   No   |
| Change member roles      |  Yes  |  Yes  |   No   |   No   |
| Manage API keys          |  Yes  |  Yes  |   No   |   No   |
| Change billing plan      |  Yes  |  Yes  |   No   |   No   |
| Update security settings |  Yes  |  Yes  |   No   |   No   |
| Delete workspace         |  Yes  |   No  |   No   |   No   |
| Transfer ownership       |  Yes  |   No  |   No   |   No   |

## Member lifecycle

<Steps>
  <Step title="Invitation">
    An admin or owner invites a member by email. If `allowed_email_domains` is set, only matching emails are accepted.
  </Step>

  <Step title="Pending">
    The invited user receives an email. Their status is `pending` until they accept.
  </Step>

  <Step title="Active">
    After accepting, the member has full access based on their assigned role.
  </Step>

  <Step title="Role change">
    Admins and owners can change a member's role at any time.
  </Step>

  <Step title="Removal">
    Members can be removed by admins/owners. Removal is immediate and logged in the audit trail.
  </Step>
</Steps>

<Warning>
  Removing the last owner from a workspace is not allowed. Use **Transfer Ownership** first.
</Warning>