Members and roles
Give members exact permissions with Organization roles and resource scopes.
An Organization role is a reusable set of fixed permissions and explicit scopes. A member can hold several roles; effective access is the union of their valid grants.
Assign access
- Open Access in the Backend sidebar. People with access lists members and the roles granting their access; search by name, email, or role. Roles granting access shows those roles and their assignments. Use Manage members to assign existing roles or manage invitations. Organization roles opens the full role list.
- Create a custom role only when existing roles are insufficient. Start with its display name; the editable role key is suggested from the name and becomes immutable after creation. Search the permission groups and review Selected access. When creation starts from a Backend, newly enabled Backend-scoped grants default to that Backend. Changing the default for new grants leaves existing selections unchanged; Organization-wide permissions remain Organization-wide.
- Set every required scope to All or Selected, then assign one or more roles to the member.
- Test both an allowed action and an out-of-scope action. Navigation visibility is not an authorization test.
The member and role links carry the owning Organization and the originating Backend/Environment in their URL. Opening them in a new tab preserves that context without changing your session’s active Organization. A return link leads back to the originating Backend. Choosing another Organization clears the unrelated Backend context.
The governance shell labels the current responsibility as Governor, Approver, Operator, or Observer from live permissions. Its Backend and Environment selectors preserve exact scope, and navigation shows only permitted governance areas: Overview, Changes, Operations, Access, Delivery, Audit, and Settings. Organization-bound OAuth grants and the member’s separate Agent Auth identities appear under Organization management → Connections, not inside a Backend. Routine Content, Media, model, and Taxonomy authoring do not appear in this shell. The Management API still rechecks every request; hidden navigation is explanatory, not authorization.
Viewing this Backend page uses backend.read and ac.read. Role creation, changes, and deletion use ac.create, ac.update, and ac.delete. Membership actions use member.create, member.update, or member.delete; invitations use invitation.create or invitation.cancel. Candidate and Operation governance uses scoped operation.read, operation.execute, operation.approve, operation.cancel, operation.retry, and privileged operation.rollback; approval still requires the policy’s exact domain permission.
Scope rules
| Scope | Limits |
|---|---|
| Backend | The stable product and governance boundary |
| Environment | Isolated CMS state inside the selected Backend |
| Data Type | Selected Content or Asset types |
| Locale | Localized reads or edits for actions that support it |
| Vocabulary | Selected Taxonomy Vocabularies |
| Resource | Exact managed resources, including Content or Assets |
| Field | Exact fields allowed to enter reads or proposed edits |
Choose Selected to narrow a supported dimension. When Jetrepo cannot list that dimension in the role editor, enter the exact IDs separated by commas; an empty selected list grants no access.
One role must contain both the permission and a scope matching the target. Missing or malformed required scope denies the action. Backend-scoped CMS permissions also require an Environment scope. Selecting today’s main does not grant future Environments; choose All Environments only when future access is intentional. There are no deny rules, role ranks, precedence rules, or direct-user exceptions.
The protected admin role grants the fixed catalogue. basic_member has only access-control read compatibility and no broad CMS grant.
Connections
Open Connections in the sidebar or account menu to review your delegated apps and agents. A Backend link carries its Organization and return context. Connected apps shows OAuth authorization and last-used evidence. Connect an agent app opens setup instructions. When returning from a Backend, copy its working context or return to its Overview. Direct visits use your active Organization, or the only Organization available; otherwise choose one. An unavailable Organization leaves the chooser visible.
The Organization selector filters OAuth MCP app connections. Advanced: Agent Auth identities contains the separate optional account-wide identities. They are not required for an OAuth connection. Revoking an identity affects all its access; revoking a grant removes only that capability. Any signed-in Organization member can inspect and revoke only their own delegated connections.