User roles

Every LeanSignal user has exactly one role in a tenant. The role determines which areas of the app the user can access and whether they can change anything there. Areas a role cannot access are hidden from its navigation entirely.

The three roles

Role	Summary
Admin	Sees and manages everything, including Settings (user management, invitations, data retention, support cases, and the audit log).
Editor	Sees and manages everything except Settings: agents, demands, dashboards, alerting, notification channels, synthetic checks, and ingestion rules.
Viewer	Read-only. Sees Home, Dashboards, Alerts, Synthetics, and the Logs, Metrics, and Traces pages; can use LeanBuddy and manage their own preferences.

Permissions

Manage = create, edit, and delete. View = read-only. Use = full interactive use. — = no access (the area is hidden).

Area	Admin	Editor	Viewer
Home	View	View	View
Dashboards	Manage	Manage	View
Logs, Metrics & Traces (explore)	View	View	View
Ingestion rules (on the signal pages)	Manage	Manage	View
Synthetics	Manage	Manage	View
Alerts	Manage	Manage	View
Notification channels	Manage	Manage	—
Agents	Manage	Manage	—
Demands	Manage	Manage	—
LeanBuddy (AI assistant)	Use	Use	Use
Personal preferences (incl. access tokens)	Manage	Manage	Manage
Settings (users, data retention, support & audits)	Manage	—	—

Note

A few capabilities cut across the table:

• Revealing or copying an agent key is admin-only, even though editors manage agents. Editors and viewers always see keys masked.
• Every role can chat with LeanBuddy, but editing its tenant notebook needs editor or admin.
• Every role can mint read-only access tokens (for the CLI and MCP); tokens with write scopes need editor or admin. A token never grants more than your role does.
• Editing an agent’s collector configuration — from the app or the CLI — is admin-only.

Assigning roles

A user’s role is set by an admin: initially when the invitation is created, and at any time afterwards from Settings → Users — see Manage users. Role changes take effect on the user’s next session.