Access Levels
Access Level controls two things: which parts of the admin panel a user can see, and which tenant-wide actions (like inviting users) they can perform. It does not control what a user can do inside a project — that is the Role.
The three levels
| Level | Admin panel access | Can invite users? | Can manage roles? | Can create projects? |
|---|---|---|---|---|
| Regular User | None — no admin panel | No | No | No |
| Project Admin | Admin panel (limited view) | No | No | Yes |
| Tenant Admin | Full admin panel | Yes | Yes | Yes |
Regular User
The default level for most team members. Regular Users have no access to the admin panel — they work entirely within the projects they have been added to. What they can do inside those projects is determined by their Role.
Project Admin
Grants access to the admin panel with a limited scope. Project Admins can create, edit, and delete projects, manage project members, and configure a broad set of workspace-level settings.
Specifically, a Project Admin can manage templates, fields, statuses, lifecycles, cycle types, tags, environments, and external integrations — all of which are configured once for the whole workspace, not per project.
Project Admins cannot:
- Invite users. Inviting is reserved to Tenant Admins — a Project Admin can see the workspace’s users but not add one. Attempting it is refused by the server.
- Manage roles or change anyone’s Access Level.
- Change authentication settings — see Authentication.
“Limited” means limited to people, not to settings. The line between Project Admin and Tenant Admin is drawn around users, roles, and authentication — not around workspace configuration. If you need someone to set up templates and fields but not to hand out access, Project Admin is the level you want.
Tenant Admin
Full administrative access. Tenant Admins can manage all users, create and modify Roles, configure workspace settings, and perform all Project Admin actions. Assign this level carefully — it grants full control over the workspace.
How to change a user's Access Level
- Go to Admin → Users and open the All Users tab.
- Find the user and click the actions button (or their row) to open the edit modal.
- Select the new Access Level from the dropdown.
- Save the changes. The user's admin panel access updates immediately on their next page load.
You cannot change your own Access Level. This is intentional — it prevents accidental self-demotion and privilege escalation. Another Tenant Admin must make the change.
Access Level and invitations
When inviting a new user, you set their Access Level as part of the invitation form. It applies from the moment they accept. The default selection is Regular User — you must explicitly choose Project Admin or Tenant Admin if needed.
Sending invitations requires the Tenant Admin level. Project Admins do not have it, so the invitation actions are not available to them.
"Why can't I put admin permissions like Manage Users into a custom role?" Permissions like Manage Users and Manage Roles are tenant-level permissions — they are granted exclusively by Access Level, not by Roles. Roles can only contain project-level permissions (test cases, runs, etc.). This separation is intentional: it prevents anyone with role-editing access from accidentally granting themselves or others admin capabilities.