Role-Based Access Control (RBAC)

Control access to crews, tools, and data with roles, scopes, and granular permissions.

Overview

RBAC in CrewAI AMP enables secure, scalable access management through two layers:

1. Feature permissions — control what each role can do across the platform (manage, read, or no access)
2. Entity-level permissions — fine-grained access on individual automations, environment variables, LLM connections, and Git repositories

Users and Roles

Each member in your CrewAI workspace is assigned a role, which determines their access across various features.

You can:

• Use predefined roles (Owner, Member)
• Create custom roles tailored to specific permissions
• Assign roles at any time through the settings panel

You can configure users and roles in Settings → Roles.

1. Open Roles settings

   Go to Settings → Roles in CrewAI AMP.

2. Choose a role type

   Use a predefined role (Owner, Member) or click Create role to define a custom one.

3. Assign to members

   Select users and assign the role. You can change this anytime.

Predefined Roles

Role	Description
Owner	Full access to all features and settings. Cannot be restricted.
Member	Read access to most features, manage access to environment variables, LLM connections, and Studio projects. Cannot modify organization or default settings.

Configuration summary

Area	Where to configure	Options
Users & Roles	Settings → Roles	Predefined: Owner, Member; Custom roles
Automation visibility	Automation → Settings → Visibility	Private; Whitelist users/roles

---

Feature Permissions Matrix

Every role has a permission level for each feature area. The three levels are:

• Manage — full read/write access (create, edit, delete)
• Read — view-only access
• No access — feature is hidden/inaccessible

Feature	Owner	Member (default)	Available levels	Description
usage_dashboards	Manage	Read	Manage / Read / No access	View usage metrics and analytics
crews_dashboards	Manage	Read	Manage / Read / No access	View deployment dashboards, access automation details
invitations	Manage	Read	Manage / Read / No access	Invite new members to the organization
training_ui	Manage	Read	Manage / Read / No access	Access training/fine-tuning interfaces
tools	Manage	Read	Manage / Read / No access	Create and manage tools
agents	Manage	Read	Manage / Read / No access	Create and manage agents
environment_variables	Manage	Manage	Manage / No access	Create and manage environment variables
llm_connections	Manage	Manage	Manage / No access	Configure LLM provider connections
default_settings	Manage	No access	Manage / No access	Modify organization-wide default settings
organization_settings	Manage	No access	Manage / No access	Manage billing, plans, and organization configuration
studio_projects	Manage	Manage	Manage / No access	Create and edit projects in Studio

When creating a custom role, most features can be set to Manage, Read, or No access. However, environment_variables, llm_connections, default_settings, organization_settings, and studio_projects only support Manage or No access — there is no read-only option for these features.

---

Deploying from GitHub or Zip

One of the most common RBAC questions is: “What permissions does a team member need to deploy?”

Deploy from GitHub

To deploy an automation from a GitHub repository, a user needs:

1. crews_dashboards: at least Read — required to access the automations dashboard where deployments are created
2. Git repository access (if entity-level RBAC for Git repositories is enabled): the user’s role must be granted access to the specific Git repository via entity-level permissions
3. studio_projects: Manage — if building the crew in Studio before deploying

Deploy from Zip

To deploy an automation from a Zip file upload, a user needs:

1. crews_dashboards: at least Read — required to access the automations dashboard
2. Zip deployments enabled: the organization must not have disabled zip deployments in organization settings

Quick Reference: Minimum Permissions for Deployment

Action	Required feature permissions	Additional requirements
Deploy from GitHub	crews_dashboards: Read	Git repo entity access (if Git RBAC is enabled)
Deploy from Zip	crews_dashboards: Read	Zip deployments must be enabled at the org level
Build in Studio	studio_projects: Manage	—
Configure LLM keys	llm_connections: Manage	—
Set environment vars	environment_variables: Manage	Entity-level access (if entity RBAC is enabled)

---

Automation‑level Access Control (Entity Permissions)

In addition to organization‑wide roles, CrewAI supports fine‑grained entity-level permissions that restrict access to individual resources.

Automation Visibility

Automations support visibility settings that restrict access by user or role. This is useful for:

• Keeping sensitive or experimental automations private
• Managing visibility across large teams or external collaborators
• Testing automations in isolated contexts

Deployments can be configured as private, meaning only whitelisted users and roles will be able to interact with them.

You can configure automation‑level access control in Automation → Settings → Visibility tab.

1. Open Visibility tab

   Navigate to Automation → Settings → Visibility.

2. Set visibility

   Choose Private to restrict access. The organization owner always retains access.

3. Whitelist access

   Add specific users and roles allowed to view, run, and access logs/metrics/settings.

4. Save and verify

   Save changes, then confirm that non‑whitelisted users cannot view or run the automation.

Private visibility: access outcomes

Action	Owner	Whitelisted user/role	Not whitelisted
View automation	✓	✓	✗
Run automation/API	✓	✓	✗
Access logs/metrics/settings	✓	✓	✗

The organization owner always has access. In private mode, only whitelisted users and roles can view, run, and access logs/metrics/settings.

Deployment Permission Types

When granting entity-level access to a specific automation, you can assign these permission types:

Permission	What it allows
run	Execute the automation and use its API
traces	View execution traces and logs
manage_settings	Edit, redeploy, rollback, or delete the automation
human_in_the_loop	Respond to human-in-the-loop (HITL) requests
full_access	All of the above

Entity-level RBAC for Other Resources

When entity-level RBAC is enabled, access to these resources can also be controlled per user or role:

Resource	Controlled by	Description
Environment variables	Entity RBAC feature flag	Restrict which roles/users can view or manage specific env vars
LLM connections	Entity RBAC feature flag	Restrict access to specific LLM provider configurations
Git repositories	Git repositories RBAC org setting	Restrict which roles/users can access specific connected repos

---

Common Role Patterns

While CrewAI ships with Owner and Member roles, most teams benefit from creating custom roles. Here are common patterns:

Developer Role

A role for team members who build and deploy automations but don’t manage organization settings.

Feature	Permission
usage_dashboards	Read
crews_dashboards	Manage
invitations	Read
training_ui	Read
tools	Manage
agents	Manage
environment_variables	Manage
llm_connections	Manage
default_settings	No access
organization_settings	No access
studio_projects	Manage

Viewer / Stakeholder Role

A role for non-technical stakeholders who need to monitor automations and view results.

Feature	Permission
usage_dashboards	Read
crews_dashboards	Read
invitations	No access
training_ui	Read
tools	Read
agents	Read
environment_variables	No access
llm_connections	No access
default_settings	No access
organization_settings	No access
studio_projects	No access

Ops / Platform Admin Role

A role for platform operators who manage infrastructure settings but may not build agents.

Feature	Permission
usage_dashboards	Manage
crews_dashboards	Manage
invitations	Manage
training_ui	Read
tools	Read
agents	Read
environment_variables	Manage
llm_connections	Manage
default_settings	Manage
organization_settings	Read
studio_projects	No access

---

Need Help?

Contact our support team for assistance with RBAC questions.