Roles and permissions in Athenode Pro

This page lists the server roles and the project roles of Athenode Pro and everything each role can do with specifications, ToDo cards, plugins, the plugin library, the project and the SSH gateway. Athenode Pro is the Athenode server a team runs itself, with accounts, project roles and a licence. The local athenode daemon has no roles: everyone who uses it can do everything.

Every account on a Pro server has two kinds of role. Its server role, administrator or member, decides what it can do on the server as a whole. Its project role, owner, editor or viewer, decides what it can do in one project, and an account can have a different project role in each project.

Server roles apply on every tier. Pro tiers describes what changes after a downgrade to Pro Solo.

Server roles

An administrator sets an account's server role on the Users page, and chooses it in each invitation, as users and sign-in describes.

Server role	What it can do
Administrator	Everything a member can do, and the rights of an owner in every project of the server, including projects in which it has no project role. Manages accounts, invitations and groups on the Users and Groups pages, the Security and Single sign-on sections of Settings, the MCP clients, License and Audit forwarding pages, and the SSH gateway's server-wide settings, denylist, global allow rules and webhook. Exports the gateway audit of every account. Sees the notice of a new Pro version.
Member	Creates projects and imports project archives, and works in each project with its project role. Manages its own password, two-factor sign-in and sessions on the Account page. Exports its own gateway audit.

The server always keeps one enabled administrator: the last one cannot be disabled or made a member. Accounts that sign in with single sign-on are created as members, and an administrator can make them administrators afterwards.

How an account gets a project role

• An account or a group receives a project role on the project's Members page. A role given to a group applies to every account in the group, including the accounts that single sign-on adds to it at each sign-in.
• When an account has several roles in one project, directly and through groups, the highest of them applies. Owner is above editor, and editor is above viewer.
• Every enabled account can create a project and becomes its owner. The account that imports a project archive becomes the owner of the new project.
• An account without a role in a project sees nothing of it. The project is missing from its Projects page, the project's pages and the account's AI agent answer as they would for a project that does not exist, and none of the project's live updates reach the account. Administrators see every project.
• A project always keeps an owner. Revoking or lowering the role of its last owner, deleting the group that holds the last owner role, removing that owner from the group and disabling that owner's account are refused with "A project must keep at least one owner: grant the owner role to someone else first."
• A change of role applies at once, and the account's open pages show the project as the new role allows.

Seats count accounts, not roles. An enabled account takes one seat of the organisation's Pro tier whether it has roles in many projects or in none. The Pro licence covers seats.

What each project role can do

The table covers every part of a project. A specification is one described piece of work, with a title, a summary, Markdown content, a status and its own questions and answers, and a blocker is a dependency between two specifications. A ToDo card is a short note of work to do later. A plugin is a named bundle of what your AI coding tools work with: skills, agents, rules, MCP servers and plugin files. The plugin library is the shared catalogue of plugins that projects have published. The SSH gateway is the part of Athenode through which your AI agent runs commands and transfers files on your SSH hosts, and a connection is one SSH host in it.

"Yes" means the role can do it in the project. An administrator can do everything in the Owner column in every project.

Area	Action	Viewer	Editor	Owner
Project	See the project on the Projects page, its Overview and Project settings	Yes	Yes	Yes
Project	Copy the MCP URL and the project id	Yes	Yes	Yes
Project	Export the project as an archive with Export project	Yes	Yes	Yes
Project	See who has which role on the Members page	Yes	Yes	Yes
Project	Grant, change and revoke roles on the Members page	No	No	Yes
Project	Rename the project	No	No	Yes
Project	Delete the project	No	No	Yes
Specifications	Read specifications in the Tree and Orbit views, with their content, implementation plan, questions and answers and blockers; search them	Yes	Yes	Yes
Specifications	Create, edit and move specifications, change their status	No	Yes	Yes
Specifications	Add, edit and clear an implementation plan	No	Yes	Yes
Specifications	Ask and answer questions	No	Yes	Yes
Specifications	Add and remove blockers with Manage blockers	No	Yes	Yes
Specifications	Delete a specification and its subtree	No	No	Yes
ToDo cards	Read cards in every tab, filter them by type	Yes	Yes	Yes
ToDo cards	Create and edit cards	No	Yes	Yes
ToDo cards	Mark a card done, dismiss it, reopen it	No	Yes	Yes
ToDo cards	Answer a card's questions	No	Yes	Yes
ToDo cards	Convert a card to a specification	No	Yes	Yes
Plugins	Read the plugins with their agents, skills, MCP servers, rules and files	Yes	Yes	Yes
Plugins	Install a plugin into a repository with athenode init and athenode sync	Yes	Yes	Yes
Plugins	Create a plugin, change its name, description and slug, set it as active	No	Yes	Yes
Plugins	Create, edit and remove agents, skills, MCP servers, rules and plugin files	No	Yes	Yes
Plugins	Clone a plugin, also into another project, and pull from another plugin	No	Yes	Yes
Plugins	Import and update external plugins, import skills, add servers from the MCP catalogue, keep personal GitHub and GitLab tokens on the Imports page	No	Yes	Yes
Plugins	Delete a plugin	No	No	Yes
Plugin library	Browse the Library page and open entries	Yes	Yes	Yes
Plugin library	Sign in to an Athenode account on the Library page	No	Yes	Yes
Plugin library	Add an entry as a new plugin, merge it into a plugin, update a plugin added from the library	No	Yes	Yes
Plugin library	Change an entry's name, description, category or public display from an AI agent	No	Yes	Yes
Plugin library	Publish a plugin to the library, and publish a new version	No	No	Yes
Plugin library	Unpublish an entry from an AI agent	No	No	Yes
SSH gateway	See the project's connections without their secrets, Live, History, sessions, the output of what already ran, background jobs and the health of services	Yes	Yes	Yes
SSH gateway	Run commands, background jobs, file tools and transfers through a connection	No	Yes	Yes
SSH gateway	Test a connection with your own login, run a health check with Run now	No	Yes	Yes
SSH gateway	Keep your own personal credentials and personal rules on a connection	No	Yes	Yes
SSH gateway	Copy a connection into another project, with the owner role in that project	No	Yes	Yes
SSH gateway	Create, edit and delete connections: settings, tags, the status poll, the confirmation mode, the trusted host key	No	No	Yes
SSH gateway	Choose a connection's credential mode, set its shared credentials, test the shared login	No	No	Yes
SSH gateway	See which owners and editors have set personal credentials	No	No	Yes
SSH gateway	Manage a connection's shared allow rules and denylist additions	No	No	Yes
SSH gateway	Add, change and remove services and their health checks, set the connection's webhook	No	No	Yes

Pages that a role can read and not change show the same content without their controls. The Specifications and ToDos pages show a View only badge, and the Library and Imports pages say which role an addition or an import needs.

Publishing, editing and unpublishing a library entry also need an Athenode account that may publish to or change the entry, signed in on the Library page. An entry belongs to the Athenode account that published it, or to the billing administrators of the organisation that owns it, whatever the project roles on the Pro server. Manage your entries describes what an entry's owner changes in Athenode's web app.

Gateway actions that follow the account, not the role

Some actions in the SSH gateway belong to the account whose AI agent started them, whatever the project role:

• Only the account whose agent asked decides a pending approval in Live. Administrators decide only their own agents' actions.
• Only the account that owns a session changes its confirmation mode.
• An agent reads the status and logs of, and cancels, only the background jobs of its own account.
• Always allow saves a personal rule of the account that decides.

These settings of the gateway are for administrators only and apply to every project: the approval timeout and the other settings under Settings, the global denylist and switching one of its entries off for one connection, global allow rules and the gateway webhook. Every account can read the settings, the global allow rules and the shared rules of the connections it sees. The SSH gateway on Athenode Pro describes credentials, rules and approvals for a team.

What an AI agent can do with your role

Your AI agent works on a Pro server under your account, so it has your project role in each project and nothing more. It can read everything your role can read. An agent of a viewer can read specifications, ToDo cards, plugins and connections, and every change it tries is refused, including the specifications that /atn:mindmap writes, the stages of /atn:decompose, the cards of /atn:todo-enqueue and the settings files of /atn:settings. The skills of the standard plugin need the editor role, except that deleting a specification needs the owner role.

The agent relays these refusals:

Refusal	What it means
"Only the project's owners may delete a specification"	Deleting a specification needs the owner role.
"Only the project's owners may delete a plugin or publish and unpublish it in the library"	Deleting a plugin, publishing and unpublishing need the owner role.
"You do not have permission to do this"	The change needs a higher role in the project, which for a viewer is the editor role.
"Not allowed: your access to the connection does not permit this"	The gateway action needs a higher role in the connection's project.
A project or a connection that is not found	Your account has no role in that project, or the project does not exist.

Connect to Athenode Pro describes how an AI tool signs in to the server with your account.

The Members page

The Members page of a project lists every account and group that has a role in it, with the role. Open it from the project's links in the sidebar. Every role can read it, and owners and administrators change it. The page states the roles as "Owners manage the project and its members, editors change its data, viewers only read."

Action	Where	What happens
Grant a role	Grant a role: choose an enabled account or a group in Account or group, a Role, then Grant	"Role granted." The account, or every account in the group, can open the project at once. An account or a group that already has a role in the project is refused: "This account or group has a role in the project already."
Change a role	The Role list in the row of the account or group	The new role applies at once.
Revoke a role	Revoke in the row, then confirm "Revoke the role of" followed by the name	The account, or the group's accounts, no longer see or edit the project through this role. A role given to the account directly, or through another group, stays.

A group in the list shows how many accounts it has, and a disabled account is marked "(disabled)". Editors and viewers see the list without the controls. A project in which nobody has a role shows "Nobody has a role in this project yet; administrators reach every project."