> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

> Organization roles, project access, and two-factor authentication in Sazabi.

Access in Sazabi is governed by an **organization role** on each member, plus **project access** for restricted projects. Two-factor authentication protects each individual account. This page explains what each role can do.

## Organization roles

Every member holds one of four roles. Each higher role includes everything the lower roles can do:

| Role | Can do |
| - | - |
| **Owner** | Everything an admin can do, plus changing the organization's name, logo, and organization-wide just-in-time member provisioning. |
| **Admin** | Manages members, teams, billing, integrations, secret keys, webhooks, and project settings. Cannot change the organization's name, logo, or organization-wide just-in-time member provisioning. |
| **Member** | Day-to-day work: connect log sources, configure MCP connectors and sandbox CLIs, and work with issues. Cannot manage members, billing, or organization settings. |
| **Viewer** | Read-only access. Not currently assignable from the dashboard — invited members are Admin or Member. |

Assign roles under [**Settings > Members**](https://app.sazabi.com/settings/members). Managing members requires admin or owner. Ownership cannot be transferred from the dashboard; to change your organization's owner, [contact support](https://docs.sazabi.com/manage/support.md).

## How roles show up in the dashboard

Sazabi shows every control to every role who can reach a page. When your role cannot perform an action, the control is present but **disabled**, with a tooltip explaining what role you need — controls are never hidden by role. A page you can read but not change renders read-only rather than disappearing.

## Project access

By default, every member can reach every project in the organization. A project can be **restricted** so that only specified members have access; manage this under [**Settings > Access**](https://app.sazabi.com/settings/project-access) on the project. Restricted projects do not appear to members without access.

## Two-factor authentication

Two-factor authentication is a personal account setting, not an organization role. Each member enables it under [**Settings > Security**](https://app.sazabi.com/settings/security). It adds a second factor to sign-in and is independent of the member's organization role.

## Further reading

> [card] [Manage members](https://docs.sazabi.com/manage/members.md)
>
> Invite people and assign roles.

> [card] [Security & trust](https://docs.sazabi.com/security.md)
>
> How Sazabi protects your data.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.