Skip to main content

Roles & Permissions

Toggly uses a flexible, fine-grained permission system that combines workspace-level permissions with application-specific access control.

Permission System Overview​

Toggly's permission system operates at two levels:

  1. Workspace Permissions: Control what team members can do within a workspace (team)
  2. Application Permissions: Control access to specific applications and their feature flags

Workspace Permissions​

When inviting team members or managing their access, you can assign the following permissions (these can be combined):

Manage Applications​

Create, edit, and delete applications within the workspace. Members with this permission can:

  • Create new applications
  • Configure application settings
  • Delete applications
  • Manage application keys

Manage Users​

Invite and manage team members. Members with this permission can:

  • Invite new team members
  • Remove team members
  • Update team member permissions
  • View all team members

Note: Only the workspace owner can grant the "Manage Workspace" permission to other members.

API Access​

Generate and manage API credentials for programmatic access. Members with this permission can:

  • Create API keys
  • View and manage API credentials
  • Access the API using their credentials

Billing​

Access billing and subscription management. Members with this permission can:

  • View current subscription
  • Manage payment methods
  • Upgrade or downgrade plans
  • View billing history

Manage Workspace​

Highest level of permission for workspace management. Members with this permission can:

  • Edit workspace name and settings
  • Manage workspace-level configurations
  • All other workspace operations

Note: The workspace owner always has all permissions implicitly and their permissions cannot be modified by other members.

Application Permissions​

Each team member can have different access levels per application:

Toggle​

Can toggle feature flags on or off for an application. This permission allows:

  • Enable/disable feature flags
  • View feature flag status
  • Cannot modify feature definitions or targeting rules

Manage​

Full management access for an application. This permission allows:

  • Create and delete feature flags
  • Configure targeting rules and rollouts
  • Manage experiments
  • Configure integrations
  • All feature flag operations

How Permissions Work​

Workspace Owner​

The creator of a workspace has special privileges:

  • Cannot have permissions removed
  • Always has all permissions implicitly
  • Only member who can grant "Manage Workspace" permission to others
  • Can perform all actions within the workspace

Combining Permissions​

Workspace permissions are bitwise flags that can be combined. A team member can have multiple permissions:

  • Example: A member might have "Manage Applications" + "Manage Users" permissions
  • Permissions are additive - having multiple permissions grants access to all included capabilities

Permission Checks​

Toggly checks permissions at multiple levels:

  • Workspace operations require specific workspace permissions
  • Application operations check both workspace membership and application-specific permissions
  • API access requires the "API Access" permission at the workspace level

Special Permissions​

Requires Approval​

When this permission is set, the team member's certain actions may require approval before taking effect. This is useful for:

  • Staging/approval workflows
  • Compliance requirements
  • Additional oversight for sensitive operations

Managing Team Member Permissions​

To update a team member's permissions:

  1. Navigate to your workspace settings
  2. Go to the Team Members section
  3. Select the team member you want to modify
  4. Check or uncheck the permissions you want to grant or revoke
  5. For application-specific access, expand the application list and set Toggle or Manage permissions
  6. Save your changes

Important: Changes to permissions take effect immediately. The team member may need to refresh their browser to see the updated permissions reflected in the UI.

BeyondAuth Integration​

Enterprise customers benefit from BeyondAuth's advanced authorization capabilities:

  • Attribute-Based Access Control (ABAC): Permissions can be based on user attributes beyond simple roles
  • Policy-Based Access: Define complex access policies that adapt to context
  • Dynamic Permissions: Permissions that adjust based on time, location, or other factors
  • Complete Audit Trail: Every authorization decision is logged for compliance and debugging

BeyondAuth operates behind the scenes to enhance security without adding complexity to the user experience.

Best Practices​

1. Follow Least Privilege Principle​

Grant team members only the permissions they need to do their job:

  • Developers typically need "Manage Applications" to work with feature flags
  • Product managers might need "Toggle" access to enable/disable features
  • Finance team needs "Billing" access for subscription management

2. Use Application-Specific Permissions​

Instead of granting workspace-wide "Manage Applications" permission:

  • Grant "Manage" or "Toggle" permissions per application
  • This limits the blast radius if credentials are compromised
  • Teams can self-organize around their applications

3. Regularly Review Permissions​

  • Audit team member permissions quarterly
  • Remove access for team members who have changed roles
  • Review the audit logs to see who is accessing what

4. Protect Workspace Owner Access​

  • The workspace owner has unrestricted access
  • Consider using SSO with MFA for owner accounts
  • Document who the workspace owner is and how to contact them

5. Be Careful with "Manage Workspace"​

  • This permission grants significant control over the workspace
  • Only grant to trusted senior team members
  • Remember: only the owner can grant this permission

Next Steps​