Roles and permissions

Every person in your company has a role. The role decides what they can see, approve and change. This is the single reference for roles: the other pages link here instead of repeating the list.

The six roles

Role	In one line
Owner (shown as CEO in the app)	Runs the company in Shara. Reaches everything.
Administrator	The owner’s right hand: team, billing, settings, audit and all approvals.
Director	Leads one department: decides what their department’s agents ask for.
Operator	Does the daily work with the agents of their own department.
IT	Looks after the technical side: integrations, keys and the agents installed on machines. No business permissions.
Viewer	Read-only. Looks, changes nothing.

A few rules about roles:

• The API and some older screens call the owner role owner or ceo. ceo is an old name for the same role; owner is the one that stays.
• There is always at least one owner. You cannot remove the last one, and you cannot hand out the owner role from the team screen.
• A person can hold more than one role (for example Director and IT). They get the permissions of all of them.
• You cannot change your own role. Ask another administrator.
• The role is read on every request, not when the session started. If you lower someone’s role, the change applies on their next click.

What each role can do

Yes means allowed. Own means only what the person created or is assigned. Department means only what belongs to their department.

What	Owner	Administrator	Director	Operator	IT	Viewer
Work with agents	Any agent	Any agent	Own department	Own department	Own department	Own department, queries only
Talk to Amadeus (and reach any agent through it)	Always	Always	If enabled for the account	If enabled for the account	If enabled for the account	If enabled for the account
See runs of the company	All	All	Own	Own	Own	Own
Decide approvals	All	All	Department	No	No	No
Read the company identity	Yes	Yes	Yes	Yes	Yes	Yes
Edit the company identity	Yes	Yes	No	No	No	No
Save or forget company and agent memory	Yes	Yes	Yes	Yes	Yes	No
Create, edit, run and share flows	Yes	Yes	Yes	Yes	Yes	No
Invite people, change roles, remove access	Yes	Yes	No	No	No	No
Billing and subscription	Yes	Yes	No	No	No	No
Audit log and chain check	Yes	Yes	No	No	No	No
Company settings (business hours, name, 2FA for the whole team, spending caps)	Yes	Yes	No	No	No	No
Export all company data	Yes	Yes	No	No	No	No
Connect company connectors and manage Desktop and Server agents	Yes	Yes	No	No	Yes	No
List company API keys	Yes	Yes	No	No	Yes	No
Create company API keys that can call agents	Yes	Yes	No	No	No	No
Create personal API keys	Yes	Yes	Yes	Yes	Yes	Yes

Notes on the table:

• Work with agents. Any agent means any agent your company has on its plan. Directors, operators, IT and viewers can only reach the agents of their own department, unless Amadeus is enabled for their account. A viewer can ask questions, but the agent works in read-only mode and cannot use tools that act.
• Operators’ approvals go to a director. When an operator, an IT person or a viewer triggers an action that needs approval, it is routed to the director of the agent’s department. If there is no director, it goes to the owner and administrators.
• Directors see and decide approvals delegated to them, and approvals from agents of their own department that nobody else has been assigned. There is one director per department.
• IT can administer keys but cannot give agents access. An IT person can list and manage company keys, but only an owner or administrator can create a company key that invokes agents. This prevents someone with only technical permissions from giving themselves more power.
• Personal API keys act as the person who made them and never do more than that person can do.
• Everyone sees the shared flows and the templates. Deleting a flow, or changing who it is shared with, is for the person who created it and for owners and administrators.

Two-step verification and roles

Two-step verification is optional. The company can require it of the whole team (Settings → Security). Even when it is optional, owners and administrators need it configured for sensitive operations: inviting people, creating API keys, editing the identity, changing the password and removing their own second factor. See Account, team and access.

Which role should I give?

Start with the lowest role that lets the person work. Raising permissions later is easy; undoing what someone did with too many permissions is not.

• Someone who only needs to see how the team works: Viewer.
• Someone who works in a department every day: Operator.
• The person who leads that department and should sign off its actions: Director.
• The person who looks after integrations and keys: IT.
• Only the people who manage money and the team: Administrator.

More on how access is protected in Security and compliance.