Roles and permissions

In the merchant dashboard, permissions come from the organization member role: OWNER, ADMIN, MEMBER, MARKETING. Membership status: ACTIVE, PENDING, DECLINED. Roles combine with the SaaS plan and dashboardMode - even OWNER will not unlock Webhooks UI without Enterprise/TRIAL or REST without a paid plan.

OWNER

The owner is created when the organization is created (founder). Full workspace administration within plan and dashboardMode limits.

  • Full organization menu (subject to dashboardMode and plan)
  • Manages team under Settings → Team
  • Standard invite form does not assign OWNER - invites use ADMIN, MEMBER, or MARKETING (when Enrollments is not PAYMENTS-only)
  • Does not edit their own role or another OWNER in the typical team flow

ADMIN (organization administrator)

Organization ADMIN has the same day-to-day operational scope as OWNER on the selected organization. This is a team role, not a separate account type.

  • Can invite ADMIN / MEMBER / MARKETING (within product rules)
  • Can edit non-OWNER member roles per team UI
  • Same plan gates as OWNER (REST, Webhooks UI, tracking, branding)

MEMBER

Operational role with a hard path allowlist (MEMBER_ALLOWED_PATHS).

  • /dashboard, /dashboard/qr, /dashboard/timetable, /dashboard/chat
  • /dashboard/dues, /dashboard/dues/messages

Outside the allowlist: org settings, providers, KSeF, promotions admin, customers admin, analytics, plans, developers, enrollments services/instructors admin.

MARKETING

Enrollments messaging role. Allowlist: Home + messages; default landing is messages. Invitable only when dashboardMode is not PAYMENTS-only. SMS requires smsEnabled.

Invites and role changes

  • Settings → Team (OWNER and ADMIN only)
  • Email + role (ADMIN | MEMBER | MARKETING when available)
  • Invite valid 7 days; accept at /invite/[id]
  • Cannot invite as OWNER from the standard form

Related

  • Organization admin
  • Organization member
  • Team invites
  • Plans and limits
  • Enrollments settings and modes
In merchant docs, “administrator” in the team sense always means organization role ADMIN (or OWNER), never a separate system account type.