Organization Settings

Roles in Kenseme

Every member of an organization has one role. The role decides what they can see and change in that organization. A person who belongs to several organizations can hold a different role in each.

The four organization roles¶

Role	Can do
`Admin`	Everything `Read/Write` can, plus Organization Settings (users, invitations, labels, defaults, credentials, features) and Billing & Plan.
`Read/Write`	Create and change content: schemas, Pipelines, ontologies, bindings, glossaries, processes, attributes. Run AI features and other background work.
`Read Only`	Open and read everything in the organization. Controls that change content are hidden or disabled.
`None`	Listed as a member without a working role. Pages that need a role show an access-denied screen instead.

New invitations default to Read Only. You change a member’s role on the Users tab; see Manage users in your organization.

Admin¶

Sees Settings › Organization Settings and Settings › Billing & Plan in the sidebar. Other roles don’t.
Invites people, changes roles, and deactivates members.
Manages labels, organization-wide defaults, ontology settings, database connections and Fabric credentials, and feature flags.
Sees the organization’s background jobs, schema imports, and outgoing emails.
Isn’t limited by per-schema overrides (see below).

Most organizations give this role to one or two people.

Read/Write¶

Creates and edits schemas, tables, columns, views, procedures, functions, scripts, indexes, and relationships.
Builds Pipelines and star schema plans and generates SQL.
Creates, edits, binds, versions, and syncs ontologies.
Maintains glossaries, processes, and attribute values.
Starts AI features such as description generation, the Ontology Generator, and binding suggestions.

Most data engineers and architects have this role.

Read Only¶

Opens everything a Read/Write member can, without changing it.
Buttons that create, edit, delete, or start generation are hidden or disabled.

Good for reviewers, auditors, and downstream consumers of the model.

None¶

Keeps the person on the member list without giving them access. Use it when you want to hold a place for someone.
When they open a page they can’t use, they see You don’t have access to this page, asking them to get a role from an administrator of the organization, with Switch organization and Go to dashboard buttons.
To remove someone’s access entirely, deactivate them instead. That also frees their seat.

Members with any role see the same You don’t have access to this page screen if they open a page above their role, such as Organization Settings without the Admin role.

Per-schema overrides¶

An organization admin can give a member a different role on one schema. The schema’s Users tab (visible only to admins) lists every member with a Role drop-down and a Source column:

Inherited means the member’s organization role applies.
Overridden means a schema-specific role has been set.

A schema override can be Read/Write, Read Only, or None, and it takes precedence over the member’s organization role for that schema, in either direction. For example, you can give a Read Only member write access to one sandbox schema, or hide a sensitive schema from a Read/Write member by setting None. Organization admins always have full access, whatever the override says.

In the app: Data Model › Schemas › your schema › Users tab

Site Admin¶

Site Admin is not an organization role. It’s held by Macula staff who operate Kenseme and gives access to Settings › System Administration. See System administration. Staff addresses can’t be added to an organization as ordinary members.

A Read Only role is not a read-only organization¶

The Read Only role limits one person. A read-only organization limits everyone in it at once, whatever their role, and happens because of the organization’s billing status or an administrator’s action. See Account states and read-only mode.