Skip to content
Pathwatch Docs

Roles & permissions

Team organisations support role-based access control. Every member has exactly one role. Roles map to permissions across resources (monitors, alerts, billing, audit log, etc.).

PathWatch ships six built-in roles that work on every team org. Custom roles are a Pro+ feature.

Built-in roles

In priority order, lowest priority number = most powerful:

PriorityRoleWhat it can do
0OwnerFull control. Manage billing, members, security policies, transfer ownership, delete the org. There’s exactly one owner per org.
1AdminManage org settings, members, alert channels, runners, status pages. Cannot change billing or delete the org.
2ManagerCreate, update, delete monitors, incidents, maintenance windows, monitor groups, alert rules. Cannot manage members or alert channels.
3MemberCreate and update monitors, incidents, monitor groups, API keys. Cannot delete other people’s monitors.
4OperatorExecute checks, acknowledge and update incidents and alerts. Cannot create or delete monitors.
5ViewerRead-only access to monitors, results, status pages, audit log (where entitled). Cannot create or change anything.

A higher-priority role implicitly grants every lower-priority role’s permissions for the same resource.

The owner role transfers between members — only the current owner can pass it on, and only to an existing member of the org.

Permission matrix

Each resource has up to five permission verbs: list, view, create, update, delete. Some resources also expose execute. The default minimum role per resource:

ResourceList / ViewCreateUpdateDelete
MonitorsViewerMemberMemberManager
Monitor groupsViewerMemberMemberManager
Alerts (active)ViewerMemberOperatorManager
Alert rulesViewerMemberMemberManager
Alert channelsViewerAdminAdminAdmin
Escalation policiesViewerAdminAdminAdmin
IncidentsViewerMemberOperatorManager
Maintenance windowsViewerManagerManagerAdmin
Status pagesViewerAdminManagerAdmin
ThemesViewerAdminAdminAdmin
RunnersViewerAdminAdminAdmin
API keysMemberMemberMemberMember
Org settingsViewer—AdminOwner
Org membersViewerAdminAdminAdmin
Security policiesViewer—Admin—
Custom rolesViewerAdminAdminAdmin
Audit logAdmin———
BillingOwnerOwnerOwnerOwner

API keys carry their own scopes inside the issuing user’s role — see API keys.

Custom roles (Pro+)

Settings → Members → Roles → New role to define a custom role with arbitrary permissions. Useful when the six built-in tiers are either too permissive or too restrictive for your team’s structure.

Each permission is a (resource, action) tuple — e.g. monitors:view, alerts:update, status_pages:create. The full list is shown in the role editor with check-boxes; pick what the role needs and save.

Custom roles can be assigned the same way as built-in roles. They cannot grant billing:* or org_settings:delete — those remain owner-only.

Tips

  • Use Member as the default for new teammates. Promote to Manager or Admin only for people who need to delete things or manage runners.
  • Viewer is genuinely useful — give exec / customer-success access to dashboards without risking config changes.
  • Operator is the right role for on-call rotations that should acknowledge alerts but not change monitor config.
  • Custom roles are a Pro+ feature because most teams don’t need them. If the built-in six cover your needs, stay on them.