Three roles, on purpose
Sokko keeps this simple: you invite teammates and control who can do what with exactly three roles — owner, admin, and dev. We thought a lot about whether to ship more granular permissions and decided against it: ten roles you don't understand is worse than three roles you do.
Each role nests inside the previous one. Owners can do everything admins can; admins can do everything devs can.
What each role can do
dev — the default role for new members. Devs can:
Create, redeploy, and suspend agent instances they own.
Open a live terminal and read logs for agents they own.
View and manage the secrets on agent instances they have access to.
Devs cannot touch other people's instances, modify billing, invite teammates, or change platform-wide settings.
admin — for people running the platform side of your team. Admins inherit
everything dev can do, plus:
Manage any instance in the project, not just their own.
Create, rotate, and revoke project secrets.
Invite new members and assign them roles up to
dev(only owners can promote someone to admin).See a record of every change made in the project.
owner — typically one or two people per organization. Owners inherit admin permissions, plus:
Manage billing and seat counts.
Promote and demote admins.
Transfer or delete the project.
Mapping it to a real team
For a five-person startup, we usually recommend:
1 owner — the founder, or whoever owns the account and pays the bill.
1 admin — whoever runs the platform side for your team.
3 devs — everyone else.
For a larger org, give each squad one admin and treat dev as the default. If you find yourself wanting "an admin who can't see billing," that's a sign you should be splitting the org into two projects rather than asking us for more roles.
Roles decide who can act; deciding what those people should be able to see is its own topic, and our guide to managing secrets for AI agents covers it, from API keys to rotation.
Changing roles
Role changes happen in the dashboard's Team view: pick a member and set their
role. Role changes take effect immediately and show up in that record. The Team and roles guide lists what each role can do. If
you demote yourself out of owner, you can't undo it — another owner has to put
you back.
Getting roles right is one piece of keeping agents safe. For the wider picture, including what can go wrong when an agent has too much access, read our post on AI agent security risks.