Roles & Permissions Reference Documentation

This document describes the roles, permission mappings, and access controls for Organizations, Worlds (called "rooms" in the API), and Chat messages.

---

1. Role Hierarchies

Access control is divided into two scopes: Organization scope (administrative control over the organization and its assets) and World scope (control over individual worlds, their settings, and live state).

Organization roles, from highest to lowest:

Role	API value
Owner	owner
Admin	admin
Member	member

World roles, from highest to lowest:

Role	API value	Shown in the Dashboard as
World owner	room_owner	Owner
Admin	admin	Administrator
Editor	editor	Editor
User	user	User
Guest	guest	Guest

Organization owners and admins automatically receive the matching world role in every world linked to the organization (see Section 3).

note

In the Dashboard's Admins tab you can give members the Administrator or User role. The editor and room_owner roles can be assigned through the API.

For the numeric role values used by in-world scripts, see the user-role system.

---

2. Organization-Level Permissions

Organization permissions control membership management, organization metadata, and the organization lifecycle. Organizations are currently managed through the API.

Action	Org Owner	Org Admin	Org Member	External User
View Organization	Yes	Yes	Yes	No
Delete Organization	Yes	No	No	No
Rename/Update Organization (name, logo, banner, icon, linked worlds)	Yes	Yes	No	No
Add Member (Member role)	Yes	Yes	No	No
Add Member (Admin or Owner role)	Yes	No	No	No
Invite by Email (Member or Admin role)	Yes	Yes	No	No
Invite by Email (Owner role)	Yes	No	No	No
Change a Member's Role (including promoting to Owner)	Yes	No	No	No
Remove Members	Yes	Yes (members only)	No	No
Remove Admins/Owners	Yes	No	No	No

note

An organization can have several owners, but it always keeps at least one: the last owner can't be removed or demoted.

To link a new world to an organization, you must own that world. Worlds that are already linked can be unlinked by any org owner or admin by updating the organization's linked worlds.

---

3. Dynamic World-Level Permissions (Resolved Roles)

The application uses a dynamic role resolver (PolicyService.resolved_role_for_room) that combines a user's world membership and organization memberships into one effective world role.

note

If a world is linked to an organization, the organization's owners and admins get elevated world privileges automatically, without needing a direct world membership (Userserver record). Plain organization members don't get a higher world role.

The Resolution Priority

1. Unauthenticated User: resolved to guest.
2. World Creator: if user.id == room.user_id, resolved to room_owner.
3. Organization Memberships:
   • If the user is an Owner of an organization linked to the world, resolved to room_owner.
   • If the user is an Admin of an organization linked to the world, resolved to admin.
4. Direct World Membership (Userserver):
   • If a direct world membership exists, resolved to its stored role (room_owner, admin, editor, user or guest).
5. Fallback: if nothing matches, resolved to user.

---

4. World & Message Permission Matrix

Based on the resolved role from Section 3, the following operations are allowed:

Action	World Owner	Admin	Editor	User	Guest
Delete World	Yes	No	No	No	No
Edit World Settings and Scene	Yes	Yes	Yes	No	No
Use the In-World Editor	Yes	Yes	Yes	No	No
Change Session-Only Chat Setting	Yes	Yes	No	No	No
Update the World Screenshot	Yes	Yes	Yes	No	No
Add, Change or Remove Members	Yes	Yes	No	No	No
Clone World	Yes	Yes	No	No	No
Toggle World Live State	Yes	Yes	No	No	No
Show World in App Feed	Yes	Yes	No	No	No
Delete Any Chat Message	Yes	Yes	Yes	No	No
Clear All Chat Messages	Yes	Yes	No	No	No

When adding or changing members, you can only manage members ranked below you, and you can grant at most your own role. For example, admins can add other admins, but can't change the world owner. Every user can delete their own chat messages.

The following actions check the user's direct world membership only, so a role inherited from an organization doesn't count:

Action	World Owner	Admin	Editor	User	Guest
View Stats and Logs	Yes	Yes	No	No	No
Add or Remove Components	Yes	Yes	No	No	No
Send and Manage World Invitations	Yes	Yes	No	No	No

info

• World Deletion: Only a user who resolves to room_owner can delete a world: the creator of the world, an owner of a linked organization, or a member with the room_owner role.
• Message Reading: Saved chat messages can be read by anyone with a direct membership in the world (any role) and by any member of an organization linked to the world, even if the world is private. In worlds with session-only chat, no messages are saved.