User Roles

Every Tavnit user belongs to an organisation with exactly one of four roles: Owner, Admin, Member or HITL Only. The role is set when you invite someone and decides what they can see and do across the whole app. The only per-item override is Bucket access, which is granted person by person.

Owners have unrestricted access to everything:

• Everything an Admin can do (below)
• Invite people with any role, and change the role of, or remove, any other member, including Admins and other Owners
• Edit the organisation in Settings → "Organization": name, timezone, run failure notifications and the "Failed runs" auto-retry setting
• Delete the organisation
• Make a Bucket private, and set Admins' access to any Bucket

Admins can:

• Create, edit and delete flows, Collections, Subjects, Splitters, Cleaners, agents, Inspectors, Fillers, Signals, Nets, pipelines and Buckets
• Configure agents, including the variables and secrets they use
• Manage Subject bindings and Signal recorder assignments
• Run everything and view all results
• Invite new people as Member or HITL Only
• Change the role of, or remove, Members and HITL Only users
• View the organisation's Audit Log
• Open a Bucket's Access page and set each Member's access

Admins cannot:

• Edit organisation settings
• Delete the organisation
• Make a Bucket private
• Change another Admin's or an Owner's role, access or membership
• Invite someone as Admin or Owner

Members can:

• Trigger flow runs and view all runs and results
• View flow details, including fields and every feature's settings
• Run splits, agents, Inspectors, Fillers, pipelines, Signal waves and Net catches
• Work Cases in Subjects: open, edit and close them, upload documents, resolve held documents and run checks
• Create, edit, delete and run any Matcher
• View all org-visible Buckets, and edit a Bucket's data if an Owner or Admin grants them Editor access
• See the Team page and their own API key

Members cannot:

• Create flows, Collections, Subjects, Splitters, Cleaners, agents, Inspectors, Fillers, Signals, Nets, pipelines or Buckets
• Edit or delete configuration they didn't create, or toggle flow features (webhook, email trigger, email output, data cleaning, Bucket Export)
• Invite, remove or change the role of anyone
• See private Buckets unless explicitly granted access, or open a Bucket's Access page
• See organisation settings or the Audit Log

HITL Only is a deliberately narrow role: the holder can review and decide on the items they are assigned to, and nothing else. Their sidebar shows only the Human in the Loop queue, and every processing and data operation is refused, in the app and over the API alike.

Someone with this role can:

• Open the Human in the Loop queue and see the runs, matches, inspections and fills awaiting their review
• Read the extracted data next to the source document
• Edit values, add or drop rows and columns during review
• Approve an item, or reject it with a reason

They cannot:

• Upload a document or trigger a run of any kind
• See the dashboard, Runs, or any feature's configuration
• Read or write Bucket data outside a review
• Call the processing API: those endpoints refuse the role outright
• Invite anyone, or see organisation settings

What Owner, Admin and Member can each do, feature by feature. HITL Only is deliberately absent: it is denied every row in this table, and its only capability is reviewing items it has been assigned.

Owners and Admins invite people from the Team page:

1. 1Go to Team and click "Invite Member"
2. 2Choose "By email" and enter their address, or "Invite code" to create a code you share yourself
3. 3Pick the role. Admins can only offer Member or HITL Only; Owners can offer any role
4. 4Click "Send invitation". Tavnit emails a Tavnit invitation with a link to join; if they have no account yet, they create one on the way in

Invitations and codes expire after 7 days. Under “Pending Invitations” you can “Resend” an email, “Copy link” to send it another way, or revoke it. Later, use “Change Role” or remove someone from the member list.

• Each member has their own API key (Settings → “Account” → “API Key”), and requests made with it are limited to that member's role. HITL Only keys are refused by the processing endpoints.
• The MCP connector is generated from your own key on the Integrations page, so an AI assistant using it has exactly your permissions. The connector is enabled per organisation on request.
• Agents, Signals, Nets and Bucket chat are also enabled per organisation. When they are off, they don't appear for anyone, whatever their role. Contact support to turn them on.

Buckets have a second access layer that lets Owners and Admins control exactly who can see and edit each Bucket, on top of the org role.

To manage access, open the Bucket's details page and choose “Access”. The page groups people by role and shows each person's level; you can set it individually, use “Set all:” to update a whole group at once, or reset an override back to the role's default.