Role-Based Access Control
A detailed breakdown of what each role can access and modify.
4 min readSecurity & Compliance
Ayorax enforces role-based access on every API endpoint and UI screen. There are three roles: Admin, Manager, and Member.
Permissions matrix
| Feature | Admin | Manager | Member |
|---|---|---|---|
| View leads & pipeline | ✓ | ✓ | ✓ |
| Edit assigned leads | ✓ | ✓ | ✓ |
| Create / edit campaigns | ✓ | ✓ | ✗ |
| Launch Lead Engine | ✓ | ✓ | ✗ |
| Build automation workflows | ✓ | ✓ | ✗ |
| Configure AI Knowledge Base | ✓ | ✓ | ✗ |
| Manage API keys | ✓ | ✓ | ✗ |
| Billing & subscription | ✓ | ✗ | ✗ |
| Organization settings | ✓ | ✗ | ✗ |
| Security settings | ✓ | ✗ | ✗ |
| Invite / remove members | ✓ | ✗ | ✗ |
| White label settings | ✓ | ✗ | ✗ |
API-level enforcement
Role checks are enforced server-side on every API request. A Member's API key cannot access Manager or Admin endpoints — even if the frontend is bypassed.
Follow the principle of least privilege: assign Members to most users, Manager to team leads, and Admin only to the account owner and their backup.
Related articles
Was this article helpful?