Roles & Permissions

What each organization role can do on the Galtea platform

Galtea uses role-based access control. Every member of your organization has one role that decides what they can see and change. This page lists the four organization roles and the actions each one can perform. Actions cover the standard operations (Create, Read, Update, Delete) plus a soft delete (a logical delete that hides a record without removing it). Many permissions are conditional, shown as a short rule in the cell.

Roles

• OWNER: Manages users and resources in their own organization. Cannot hard-delete.
• MEMBER: Day-to-day access in their organization: view and contribute, with limited edits. Cannot hard-delete.
• HUMAN_EVALUATOR: Read-only across the organization, plus may annotate AI metrics and submit human evaluations.
• READER: Read-only across the organization. Cannot create, update, or delete anything.

Each cell shows what a role can do for that action. ✅ means allowed and ❌ means not allowed. A short rule (for example, “If product in own org”) means the action is allowed only when that rule is true at the time, checked against your organization and the record’s ownership.

Permissions by area

Identity & Organization

User

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If target in own org	❌	❌	❌
Read	If target in own org	If target in own org	If target in own org	If target in own org
Update	If target in own org	Only self	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If target in own org, not self, and not an admin	❌	❌	❌

Organization

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	❌	❌	❌	❌
Read	Own org	Own org	Own org	Own org
Update	Own org	❌	❌	❌
Delete	❌	❌	❌	❌
Soft delete	❌	❌	❌	❌

Test Assets

Product

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If product in own org	If product in own org	❌	❌
Read	If product in own org	If product in own org	If product in own org	If product in own org
Update	If product in own org	If product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If product in own org	If product is theirs (by userId)	❌	❌

Version

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent product in own org	If parent product in own org	❌	❌
Read	If parent product in own org	If parent product in own org	If parent product in own org	If parent product in own org
Update	If parent product in own org	If parent product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent product in own org	If parent product in own org	❌	❌

Test

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent product in own org	If parent product in own org	❌	❌
Read	If parent product in own org, or test is global	If parent product in own org, or test is global	If parent product in own org, or test is global	If parent product in own org, or test is global
Update	If parent product in own org	If parent product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent product in own org	If parent product in own org	❌	❌

Test Case

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If parent test in own org	If parent test in own org	❌	❌
Read	If parent test in own org, or test is global	If parent test in own org, or test is global	If parent test in own org, or test is global	If parent test in own org, or test is global
Update	If parent test in own org	If parent test in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If parent test in own org	If parent test in own org	❌	❌

Evaluation & Results

Evaluation

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Read	If evaluation’s product in own org	If evaluation’s product in own org	If evaluation’s product in own org	If evaluation’s product in own org
Update	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If evaluation’s product in own org	If evaluation’s product in own org	❌	❌
Annotate AI metric	✅	✅	✅	❌
Human evaluation	✅	✅	✅	❌

Annotating or submitting human evaluations also requires membership in the relevant User Group; the table shows the role-level gate only.

Inference Result

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If result’s product in own org	If result’s product in own org	❌	❌
Read	If result’s product in own org	If result’s product in own org	If result’s product in own org	If result’s product in own org
Update	If result’s product in own org	If result’s product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If result’s product in own org	If result’s product in own org	❌	❌

Monitor

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If product in own org	If product in own org	❌	❌
Read	If product in own org	If product in own org	If product in own org	If product in own org
Update	If product in own org	If product in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If product in own org	If product in own org	❌	❌

Reference Data

Metric

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If metric in own org	If metric in own org	❌	❌
Read	If in own org, or global	If in own org, or global	If in own org, or global	If in own org, or global
Update	If metric in own org	If metric in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If metric in own org	If metric in own org	❌	❌

Model

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Create	If model in own org	If model in own org	❌	❌
Read	If in own org, or global	If in own org, or global	If in own org, or global	If in own org, or global
Update	If model in own org	If model in own org	❌	❌
Delete	❌	❌	❌	❌
Soft delete	If model in own org	If model in own org	❌	❌

Analytics & Insights

Analytics

Action	OWNER	MEMBER	HUMAN_EVALUATOR	READER
Read	If data in own org	If data in own org	If data in own org	If data in own org

Notes

• Read-only roles: READER and HUMAN_EVALUATOR can read exactly what a MEMBER can read (the same organization scope). They cannot create, update, or delete. HUMAN_EVALUATOR additionally may annotate AI metrics and submit human evaluations; READER cannot.
• Organization scope: “In own org” means the record (or its parent, such as a Product) has an organizationId equal to the signed-in user’s organization. This keeps each client organization’s data separate.
• Parent scope: For nested records (Version, Test, Evaluation, and so on) access is derived from the parent’s organization. Example: a Version belongs to a Product, and the Product belongs to an Organization. An Evaluation is reached through session to version to product.
• Global records: Some records (Metric, Model, and a Test with no product) can be global, meaning not tied to one organization. Global records are readable by every role in addition to their own organization’s records.
• Hard delete: None of these roles can permanently delete records. Where deletion is shown it is a soft delete: the record is hidden, not removed.