Organizations and roles
Everything in Rockslab belongs to an organization, and everybody in it has one role. The role decides what they can see and press.
The organization
An organization is the box everything else lives in: cloud accounts, clusters, domains, keys, apps, invoices, people. One person can belong to several; the switcher at the top of the sidebar moves between them. Nothing crosses from one organization to another — not data, not keys, not a stray kubectl context.
Whoever creates the organization is its owner.
Roles
| Role | Can | In a cluster |
|---|---|---|
| Owner | Everything, including deleting the organization. | cluster-admin |
| Admin | Everything except deleting the organization. | cluster-admin |
| Billing | Invoices and payment details, plus reading everything else. | nothing |
| Operator | Run operations: build, grow, install, schedule — on cloud accounts and infrastructure inside their scope. | workloads in namespaces an admin made for them; read the rest |
| Member | Read, inside their scope. | view |
Only owners, admins and the billing role see money. Everyone else sees no prices, no invoices and no Billing & plan in the menu — the bill is not their problem, and we would like to keep it that way.
Scope
An operator or a member can be limited to part of the organization: named clusters, accounts or projects, or everything carrying a label — clusters env=dev reaches every cluster labelled env=dev. Change the label and access moves with it. Owners, admins and billing always see the whole organization.
Inviting people
Access › People lists who is in; Access › Invitations lists who has been asked. Type an email, pick a role, press Invite — or Invite link to send the link yourself. An invitation works for 7 days. Only owners and admins invite.
Deleting an organization
Settings › Danger zone, owners only. A deleted organization is Archived: read-only, kept for history, and restorable by its owner for 30 days. After that it is gone for good.