User Roles & Permissions

Every Tavnit user belongs to an organisation with exactly one of four roles: Owner, Admin, Member or HITL Only. The role is set when you invite someone and decides what they can see and do across the whole app — there is no per-feature override except for Bucket access grants.

Owners have unrestricted access to everything:

• Create, edit, and delete flows, buckets, collections, cleaners, and matchers
• Trigger runs and view all results
• Invite and remove any team member, including other admins
• Promote or demote members to any role (including admin)
• Edit organisation name and settings
• View and manage billing and subscription
• Delete the organisation
• Set any bucket to private
• Control all bucket access — including changing admin permissions

Admins can:

• Create, edit, and delete flows, buckets, collections, and cleaners
• Create and manage their own matchers, and edit any matcher
• Trigger runs and view all results
• Invite new members to the org (member role only)
• Remove members from the org
• Edit and delete any flow, collection, or matcher created by members
• Open the bucket access screen and change member access levels

Admins cannot:

• Edit org settings or billing
• Delete the organisation
• Set a bucket to private
• Change another admin's permissions or role
• Invite someone as admin or owner (owner only)

Members can:

• Trigger runs on existing flows and view all run results
• View flow details — including fields, webhook, email trigger, email output, data cleaning, and export to bucket settings
• Create, edit, and delete their own matchers
• Run matches on existing matchers
• View all org-visible buckets (read-only by default)
• Write data to a bucket if an admin or owner grants them editor access

Members cannot:

• Create new flows, buckets, collections, or cleaners
• Edit or delete any flow, or its fields and features
• Toggle or configure flow features (webhook, email trigger, email output, data cleaning, export to bucket)
• Edit or delete matchers created by others
• Invite or remove team members
• See private buckets unless explicitly granted access
• Access the bucket access management screen
• See the billing or org settings pages

HITL Only is a deliberately narrow role: the holder can review and decide on the runs they are assigned to, and nothing else. Every processing and data operation is refused, in the app and over the API alike, with an explicit “your role only permits HITL reviews” response.

Someone with this role can:

• Open the Human in the Loop queue and see runs where they are a named reviewer
• Read the extracted data next to the source document
• Edit values, add or drop rows and columns during review
• Approve a run, or reject it with a reason

They cannot:

• Upload a document or trigger a run of any kind
• See or change flows, Collections, Cleaners, Splitters or Agents
• Read or write Bucket data outside a review
• Call the processing API — those endpoints refuse the role outright
• Invite anyone, or see billing and organisation settings

What Owner, Admin and Member can each do, feature by feature. HITL Only is deliberately absent: it is denied every row in this table, and its only capability is reviewing runs it has been assigned.

Buckets have a two-layer access system that lets owners and admins control exactly who can see and edit each bucket independently of their org role.

To manage access, open a bucket and tap the settings icon → Manage Access. The access screen groups users by role and lets you set each person's level individually, or use the “Set all” controls to update an entire group at once.