A role is a bundle of permissions you grant to a person or a group. Tines 3B ships with a set of built-in roles for each kind of resource, so in most cases you can give someone exactly the access they need without building anything custom. This article lists every built-in role and spells out what it lets someone do.

If you're new to how access works, the short version is that access is granted per resource: a space role only applies to a space, a connector role only to a connector, and so on.

A quick note before the list: within a single resource, roles aren't always a simple ladder. Some cover different needs rather than stacking on top of each other, so it's normal for one person to hold two roles on the same resource. The notes below call this out where it matters.

The tenant admin role is the top-level role. It grants full access to everything in your tenant and overrides every other check, so an admin can view and manage every space, connector, skill, group, and setting. Because it's so powerful, it's reserved for trusted administrators, and it can't be recreated as a custom role.

Everything below is more targeted access for a specific resource.

Spaces are where your workflows live. Workflows, drafts, runs, and build chats all inherit the access of their space.

Editing and managing are separate: a Space manager controls settings and access but isn't automatically able to build workflows, and a Space editor builds workflows but doesn't control access. Someone who does both needs the editor and manager roles together.

Connectors hold the credentials for the tools your workflows integrate with.

For a connector to actually work inside a space, the space's members need access to it too.

Skills are reusable instructions your AI can draw on.

Networks control how execution traffic is routed.

A group is a named set of members you can grant access to all at once.

Service accounts represent automated, non-human access.

The roles above grant access to resources that already exist. A separate set of roles lets people create new ones:

Whenever someone creates a resource, they automatically become its manager, so a Space creator who makes a new space can immediately administer it and build in it without anyone granting them access first.

If none of the built-in roles fits, an admin can build a custom role that bundles exactly the permissions you want for a given kind of resource. Custom roles follow the same rules as built-in ones, with one hard limit: they can never carry full tenant access, which stays exclusive to the Admin role.