Skip to main content

​
Role-Based Access Control

MergeGuide uses role-based access control (RBAC) to define what each member can view and do. Every member is assigned exactly one role per organization.

​
Built-in Roles

Four built-in roles cover most teams:
RoleDescription
OwnerFull organizational control, including SSO/SCIM and org deletion. Exactly one Owner per org.
AdminManages team members, policies, and SCM connections. Cannot delete the org.
DeveloperReads evaluation results. Manages their own API keys. Cannot modify policies or team settings.
ViewerRead-only access to evaluations and compliance data. No write access of any kind.
Ownership can be transferred from Settings > Team > Transfer Ownership. The previous owner becomes an Admin.

​
Built-in Role Permission Matrix

PermissionViewerDeveloperAdminOwner
View evaluationsYesYesYesYes
View compliance reportsYesYesYesYes
Export evidenceYesYesYesYes
View audit logNoNoYesYes
Manage own API keysNoYesYesYes
Enable/disable policiesNoNoYesYes
Configure custom policiesNoNoYesYes
Configure SCM connectionsNoNoYesYes
Invite membersNoNoYesYes
Remove membersNoNoYesYes
Change member rolesNoNoYesYes
Configure notificationsNoNoYesYes
Configure SSO (SAML/OIDC)NoNoNoYes
Configure SCIMNoNoNoYes
Delete organizationNoNoNoYes

​
Custom Roles

Custom roles let you define granular permission sets beyond the built-in roles. Use them when:
  • You need a role between Admin and Viewer (e.g., a security reviewer who can view audit logs but not manage team members)
  • Different teams need different subsets of policy management permissions
  • Regulatory requirements mandate finer-grained access separation

​
Creating a Custom Role

  1. Go to Settings > Team > Roles > Create Role
  2. Enter a role name and optional description
  3. Select permissions from the permission list
  4. Save
Custom roles appear in the role dropdown when inviting members or editing existing members.

​
Permission List

PermissionDescription
evaluations:readView evaluation results
evaluations:exportExport evaluation data
compliance:readView compliance coverage reports
compliance:exportExport OSCAL and evidence
policies:readView policies
policies:writeEnable, disable, and configure policies
policies:createCreate custom policies
repositories:readView connected repositories
repositories:writeConnect and disconnect repositories
team:readView team members
team:inviteInvite new members
team:removeRemove members
team:rolesChange member roles
audit_log:readView the organization audit log
api_keys:selfManage own API keys
api_keys:allView and revoke all org API keys
notifications:writeConfigure notifications
settings:ssoConfigure SSO (Owner-level action)
settings:scimConfigure SCIM (Owner-level action)

​
Example: Security Reviewer Role

A role for an internal auditor who needs read access to evaluations and the audit log, but cannot modify anything: 
Permissions:
  evaluations:read       Yes
  evaluations:export     Yes
  compliance:read        Yes
  compliance:export      Yes
  audit_log:read         Yes
  policies:read          Yes
  (all write permissions No)

​
Example: Policy Manager Role

A role for a security engineer who manages policies but cannot administer the team: 
Permissions:
  evaluations:read       Yes
  evaluations:export     Yes
  compliance:read        Yes
  policies:read          Yes
  policies:write         Yes
  policies:create        Yes
  repositories:read      Yes
  (team management       No)

​
Assigning Roles

​
At Invitation

Select the role when sending an invitation (Settings > Team > Invite Member). Custom roles appear in the role dropdown alongside built-in roles.

​
Changing an Existing Member’s Role

  1. Go to Settings > Team
  2. Find the member and click Edit
  3. Select the new role
  4. Save
Role changes take effect immediately on the member’s next page load. The change is recorded in the audit log.

​
SCIM Role Provisioning

When SCIM is configured, IdP group membership maps to MergeGuide roles. Custom roles can be mapped in Settings > Security > SCIM Provisioning > Group Mappings:
IdP GroupMergeGuide Role
mergeguide-adminsAdmin
mergeguide-security-reviewersSecurity Reviewer (custom role)
mergeguide-developersDeveloper
See SCIM Provisioning.

​
Troubleshooting

​
Custom role option not appearing

If the Roles section is not visible in Settings, contact support@mergeguide.ai.

​
Member can’t access a feature after role change

Role changes take effect on the next page load. Have the member refresh the browser. If the issue persists, verify the role’s permissions in Settings > Team > Roles.

​
Cannot change Owner role

Only the Owner can transfer ownership. If the Owner’s account is inaccessible, contact support for recovery assistance.