Members and roles
The five built-in roles and exactly what each may do, inviting people, changing roles, removing members, seats, and how a change reaches tokens already issued.
Every member of an organisation has one role. The role decides what they may do in the dashboard, and caps what any credential acting for them can do: an OAuth token, the CLI, or a key they make.
Roles
| Role | In short |
|---|---|
| Owner | Everything, including organisation settings and billing. |
| Admin | Everything but organisation settings, paying and the owner role. |
| Developer | Runs the integration: sources, runs, webhooks, exports, API keys and OAuth apps. Reads everything but billing, the audit log and single sign-on. |
| Analyst | Reads the catalogue and its activity (sources, runs, webhooks, the change feed), and makes exports. |
| Viewer | Reads the catalogue. |
What each role holds on each resource, from the policy FurniOps enforces on every request:
| Resource | Owner | Admin | Developer | Analyst | Viewer |
|---|---|---|---|---|---|
| productsProducts (master records) | Read, write | Read, write | Read | Read | Read |
| variantsVariants of products | Read, write | Read, write | Read | Read | Read |
| offersVendor prices and stock | Read, write | Read, write | Read | Read | Read |
| sourcesVendor connections | Read, write | Read, write | Read, write | Read | None |
| runsIngestion runs and their snapshots | Read, write | Read, write | Read, write | Read | None |
| webhooksWebhook endpoints and deliveries | Read, write | Read, write | Read, write | Read | None |
| eventsThe change feed | Read | Read | Read | Read | None |
| exportsBulk exports of the catalogue; making one also needs products:read | Read, write | Read, write | Read, write | Read, write | None |
| freshnessDemand hints and on-demand checks of variants | Write | Write | Write | None | None |
| api_keysAPI keys | Read, write | Read, write | Read, write | None | None |
| oauth_appsOAuth apps the organisation registers for its users to sign in to | Read, write | Read, write | Read, write | None | None |
| membersMembers and invitations | Read, write | Read, write | Read | None | None |
| orgOrganisation settings | Read, write | Read | Read | None | None |
| billingPlan, invoices and payment methods | Read, write | Read | None | None | None |
| usageMetered usage and quotas | Read | Read | Read | None | None |
| auditThe audit log; writing undoes a change it records | Read, write | Read, write | None | None | None |
| request_logsThe organisation's API request logs: who called what, and the answer | Read | Read | Read | None | None |
| ssoSingle sign-on: verified domains and identity-provider connections | Read, write | Read, write | None | None | None |
| agentThe AI agent's configuration | Read, write | Read, write | Read | None | None |
| agreementsThe vendor data agreement: reading it, and accepting it for the organisation | Read, write | Read, write | Read | None | None |
| analyticsA vendor's aggregate analytics: retailers reached, views, freshness | Read | Read | Read | Read | None |
| brandA vendor's brand profile, and its claims to speak for a brand; writing binds the organisation | Read, write | Read, write | Read | None | None |
| publishingPublishing a vendor's catalogue to the network, withdrawing it, and hiding products (VN3) | Read, write | Read, write | Read | Read | None |
| assistant_memoriesThe organisation's notes for FurniOps AI, which every member's assistant reads; a person's own notes need none | Write | Write | None | None | None |
The same permission strings are the scopes of keys and OAuth apps. A credential acting for a member holds what its scopes allow and the member's role allows, never more.
Owners
- Only an owner can grant the owner role, change an owner's role, or remove an owner.
- An organisation always keeps at least one owner. The last owner can neither leave nor be demoted.
- Owners are exempt from required single sign-on, so an owner can always get back in when the identity provider breaks.
Invite someone
Under Settings › Members, owners and admins (members:write) choose Invite someone: an
email address and a role. FurniOps emails a link to join the organisation as that role.
- The link works for 7 days, once.
- Only an account whose verified email is the invited address can accept it. Someone without an account signs up first, with that address.
- Inviting the same address again replaces its open invitation (at most once a minute).
- An address that is already a member is refused, and so is a 101st open invitation.
- Only an owner can invite someone as an owner.
- Open invitations are listed under Invitations, expired ones included, and can be revoked: the link stops working at once.
People on a domain your organisation verified for single sign-on can also join at their first sign-in through it, with the role the connection gives, without an invitation.
Seats
Members and open invitations count against the plan's seats. With none free, inviting answers
403 plan_limit_reached: remove a member or revoke an invitation,
or change the plan.
Change a role
Choose the member, then Change role. The new role applies to their next request, in every session and token they hold for this organisation: their tokens carry a membership version, and a change moves it, so a token from before the change is refused and replaced.
Remove a member
Remove member ends their access to this organisation at once, in every session and token. Their account, and any other organisations they belong to, stay as they are. API keys they made keep working until you revoke them: keys belong to the organisation. Review API keys when someone leaves.
Who can see members
Every role but Analyst and Viewer can list members (members:read). Changing members needs
members:write, held by owners and admins. Neither an API key nor an OAuth app can manage members.
Organisations
How accounts and organisations relate, creating and switching organisations, the organisation's settings, and leaving one or deleting your account.
Single sign-on
Let members sign in with your identity provider over OpenID Connect or SAML 2.0. Verify your domains, connect and test the provider, turn it on, and require it.