Roles & Permissions

Overview

SeggWat uses a role-based access control system to manage permissions within organizations. Each member of an organization has one of three roles that determine what actions they can perform.

Role Types

Owner

The highest level of access with full control over the organization.

Restrictions:

• An organization must have at least one Owner
• Cannot remove yourself as Owner if you're the last one
• Must transfer ownership before leaving the organization

Admin

Administrative access for managing the organization and its resources.

Restrictions:

• Cannot modify or remove Owner-level members
• Cannot change their own role
• Cannot manage billing or subscriptions
• Cannot delete the organization

Member

Basic access for viewing and contributing feedback.

Restrictions:

• Cannot invite or remove other members
• Cannot create or manage projects
• Cannot create or manage API keys
• Cannot modify organization settings

Permission Matrix

Managing Team Members

Inviting Members

Invitation States

Changing Member Roles

1. Go to Settings → Access Control
2. Find the member in the list
3. Click the role dropdown next to their name
4. Select the new role

Removing Members

1. Go to Settings → Access Control
2. Find the member in the list
3. Click the Remove button next to their name
4. Confirm the removal

Who Can Remove Whom:

• Owners can remove anyone (except themselves if they're the last Owner)
• Admins can only remove Members
• Members cannot remove anyone

API Key Permissions

API keys can be either full-access (grant every permission in the org) or scoped (grant a chosen subset of capabilities, optionally restricted to specific projects).

Either way, only Owners and Admins can create API keys.

Full-access keys

Full-access keys are the default and behave the same as keys minted before scoped tokens existed:

• Grant access to all projects within the organization
• Can list, retrieve, submit, and modify feedback and ratings on any project
• Can call every endpoint a logged-in admin can call

Use full-access keys for trusted backend integrations, CI/CD pipelines, and internal tooling where the operator already has admin access to the dashboard.

Scoped keys

Scoped keys carry an explicit list of capabilities and an optional project allow-list. The available scopes are:

The dashboard offers two presets in the create-key flow:

• Tester preset — feedback:write + project:list, restricted to one project, 90-day expiry. Intended for external testers using the Chrome extension.
• Custom — pick any combination of scopes, any subset of projects, and any expiry (or no expiry).

Project restriction

Any scoped key (preset or custom) can be locked to specific projects in the org. Project-restricted keys:

• Only see their allow-listed projects when calling GET /api/v1/projects — other projects in the org are filtered out, not just denied
• Fail with 403 on any endpoint targeting a project outside the allow-list

Expiry

Scoped keys can carry a hard expiry. The Tester preset defaults to 90 days. Custom keys can pick any expiry or omit it. Expired keys stay in the dashboard for audit purposes but fail authentication.

Best Practices

Common Scenarios

Scenario: Adding a Contractor

Question: I'm hiring a contractor to help process feedback. What role should I assign?

Answer: Assign them the Member role initially. This gives them read access to feedback without allowing them to modify projects or invite others. If they need to manage feedback status/types, promote them to Admin temporarily.

Scenario: Team Lead Needs More Access

Question: My team lead needs to create projects and manage API keys. What role do they need?

Answer: Promote them to Admin. This gives them full project management capabilities and the ability to create API keys, without access to billing or organization deletion.

Scenario: Founder is Leaving

Question: One of our co-founders is leaving the company. How do we transfer their ownership?

Answer:

1. Ensure you have at least one other Owner in the organization
2. The leaving Owner can demote themselves to Member or leave entirely
3. If they're the last Owner, they must first promote another trusted member to Owner before leaving

Scenario: API Key Compromise

Question: We think one of our API keys was exposed. What should we do?

Answer:

1. Go to Settings → API Tokens
2. Immediately Revoke or Delete the compromised key
3. Create a new API key with a descriptive label
4. Update your application/service with the new key
5. Monitor the "Last Used" timestamp to ensure the old key isn't being used

Scenario: Temporary External Access

Question: We need to give a partner company temporary access to view feedback for a specific project.

Answer:

1. Invite them as a Member with their email
2. Set a calendar reminder to remove them after the agreed period
3. Alternatively, create a time-limited API key and share that instead (though you'll need to monitor usage manually)

Security Considerations

Activity Tracking

SeggWat tracks the following actions for security and compliance:

• When members are invited, joined, or removed
• When roles are changed (who changed it and when)
• When API keys are created, used, revoked, or deleted
• Who created each API key and when it was last used

Frequently Asked Questions

Next Steps