What every role can and can't do — full RBAC matrix.
QorTrace uses an orthogonal RBAC model: every account user has a system role (drives raw permissions) and an optional team role (drives UX gating). Most customers only ever interact with the team role.
Team roles (what you'll see in the UI)
| Role | Sees | Best for |
|---|---|---|
| Owner | Everything | The person paying the invoice |
| Security | Audits, scans, Atlas, monitoring, alerts, settings | CISO / appsec lead |
| Sales | Customer pipeline, consultations, leads, revenue, reports | Sales ops |
| Marketing | Customers, newsletter, drip campaigns, leads | Growth marketer |
| Execs | Revenue, customers, reports (read-only) | Founders, board observers |
| Wiki Editor | Wiki / Docs admin authoring | Tech writer, DevRel |
What each role can DO (CRUD)
| Audits | Scans | Atlas | Billing | Team | Settings | Wiki | |
|---|---|---|---|---|---|---|---|
| Owner | RW | RW | RW | RW | RW | RW | RW |
| Security | RW | RW | RW | R | R | RW | R |
| Sales | R | R | — | R | R | — | R |
| Marketing | — | — | — | R | R | — | RW |
| Execs | R | R | R | R | R | — | R |
| Wiki Editor | — | — | — | — | — | — | RW |
R = read, W = write, — = no access. Wiki Editor is non-orthogonal — it adds wiki write permissions to whatever team role someone has.
Special protections
- The Owner role can only be held by one person at a time. Transfer ownership in Account → Team → Transfer ownership (the new Owner must accept).
- You cannot delete the Owner. To remove them, transfer ownership first.
- Billing actions (cancel, change plan, update card) are Owner-only by default — Enterprise can grant specific members
billing:write.
Audit-log scope
All actions are logged. Who can see the log?
- Owner / Security: full audit log
- Execs: high-level events (audits delivered, alerts fired) — no auth events
- Sales / Marketing: their own actions only
- Wiki Editor: wiki actions only
Export from Account → Settings → Audit log → Export (Pro+).
Custom roles (Enterprise)
Need a custom role? Enterprise tier lets you define your own:
- Custom permission set
- Custom sidebar visibility
- Custom default-route mapping
- Tied to a SAML group via SSO
Talk to your CSM or email enterprise@qortrace.com.