Roles and permissions

What owners, admins, billing admins, and members can do, and what API keys and app tokens can reach

Every member of a CostGraph organization has one role. The role decides what they can change in the organization. Everyone can read the organization’s spend, usage, insights, and reports.

Roles

CostGraph has four roles:

• Owner: full access, including single sign-on, deleting tenants, and deleting the organization. The person who creates the organization is its first owner.
• Admin: full access to the organization’s resources and members, except the owner-only settings.
• Billing admin: manages the subscription and connects billing sources.
• Member: uses the product day to day: reads spend and creates budgets, reports, virtual tags, and workflows.

An organization always keeps at least one owner. To transfer ownership, give another person the Owner role, then change your own.

What each role can do

The following table lists what each role can do.

Action	Owner	Admin	Billing admin	Member
Read spend, insights, Kubernetes, and VM data	Yes	Yes	Yes	Yes
Create budgets, reports, virtual tags, and workflows	Yes	Yes	Yes	Yes
Approve a workflow step	Yes	Yes	Yes	Yes
Create and manage your own API keys	Yes	Yes	Yes	Yes
Connect clouds, billing sources, and integrations	Yes	Yes	Yes	No
Set up billing exports	Yes	Yes	Yes	No
Manage the subscription and payment method	Yes	No	Yes	No
Connect ticketing tools and install Slack	Yes	Yes	No	No
Manage alert destinations	Yes	Yes	No	No
Invite members and change their roles	Yes	Yes	No	No
Manage other people’s API keys and OAuth apps	Yes	Yes	No	No
Read the audit log	Yes	Yes	No	No
Set up SSO and SCIM	Yes	No	No	No
Grant the Owner role	Yes	No	No	No
Delete a tenant or the organization	Yes	No	No	No

When a workflow step runs, CostGraph checks the role of the person who started the run, so a workflow can’t do more than its creator can.

Assign roles

You assign a role when you invite someone, and change it later under the organization’s members settings. Only an owner can invite or promote someone to Owner.

With single sign-on or SCIM, your identity provider groups can grant Member, Admin, or Billing admin. Neither changes an owner’s role. People who join through auto-join get Member.

API keys

An API key belongs to the person who created it and to one tenant. It acts with its owner’s current role, limited to the scopes you give it. If the owner’s role changes, the key’s access changes with it.

The following table lists the scopes you can give a key.

Scope	Allows
focus:read	Read cost, forecast, commitments, unit economics, and allocation coverage
focus:write	Push your own cost data
budgets:read	List budgets and read their spend
budgets:write	Create, update, and delete budgets
usage:read	Read resource usage, recommendations, anomalies, and the context graph
integrations:read	Read live data from connected services, such as quotas, limits, and settings
pricing:read	List your organization’s prices
pricing:write	Assign prices to resources. Owners and admins only
agent:read, agent:write	Used by the CostGraph Agent
operator:read, operator:write	Used by the CostGraph Operator

Some endpoints need both a scope and a role. For example, reading your CostGraph usage needs focus:read on a key whose owner is an owner or billing admin.

API keys can’t manage members, single sign-on, alert destinations, or the audit log. Those need a signed-in person.

App tokens

An app that uses Sign in with CostGraph acts as the person who approved it, with their role, in one tenant. It’s limited to the scopes they approved. App tokens can’t manage API keys, connected apps, OAuth apps, single sign-on, alert destinations, or Slack, and can’t approve workflow steps.