Brand-level permissions
Admin / Standard / Viewer.
Every brand in Skeleton Key has its own permission layer with three roles: Admin, Standard, and Viewer. These are separate from org-level roles (see Organizations & roles), which govern org-wide actions like billing and member management. Brand roles control what a person can do inside a specific brand's workspace: editing outputs, running agents, and managing the brand team.
The three brand roles
| Role | Capabilities | Restrictions |
|---|---|---|
| Admin | Edit outputs, run agents, regenerate, refine, restore versions, manage exports, add and remove brand members, change brand-role assignments | Cannot remove org Owners or Admins from the brand team (their access is org-derived) |
| Standard | Edit outputs, run agents, regenerate, refine, restore versions, manage exports | Cannot add or remove brand members or change brand-role assignments |
| Viewer | Read outputs and brand content | Cannot run agents, edit outputs, or manage the team |
Both Admin and Standard count as write access: people in either role can run agents and edit outputs. The difference is team management. Only Admin can add and remove members or change brand-role assignments.
Viewer is strictly read-only. The restriction applies at the UI level (edit affordances are hidden) and at the server level: any write request from a Viewer is blocked at the server.
How org roles interact with brand roles
Org Owners and Admins automatically have Admin brand access on every brand in the org. They do not need to be added to individual brands, and their access does not appear as a manual assignment. In a brand's team list, their access shows as org-derived. Because the access comes from their org role, you cannot remove them from the brand team directly. To revoke their brand access, change their org role to Member or Guest.
Org Members get no automatic brand access. They see only the brands that an Admin has explicitly added them to, and each brand they're added to carries its own brand role (Admin, Standard, or Viewer).
Org Guests also get no automatic brand access. When a Guest is added to a brand, the system forces their brand role to Viewer. A Guest cannot be assigned Admin or Standard at the brand level.
When to use which brand role
Assign Admin to people who need to manage the brand team itself, such as a project lead or account owner who adds and removes collaborators. Assign Standard to most working contributors: anyone who edits outputs and runs agents but has no reason to control team membership. Assign Viewer for stakeholders who need to read content without making changes, such as clients, executives, or anyone in an approval or observation role.
Last updated: 2026-04-27