Note: Organization roles control what you and your service accounts can do. Teams describe operational ownership and notification routing. These are separate controls.
Built-in roles
Section titled “Built-in roles”| Role | Purpose |
|---|---|
| Owner | Full organization administration and lockout recovery |
| Security Admin | Security operations without ownership transfer |
| Team Member | Product read baseline |
| Policy Automation | Service-account preset for draft mapping updates |
Note: The Policy Automation role is intended for service accounts and API keys. It does not include policy publication.
Understand permissions
Section titled “Understand permissions”Permissions combine a resource, such as repository or policy_group, with an
action, such as read, write, manage, or policy_publish.
When a member has more than one role, BIMP combines the valid permissions from those roles.
Use the permission matrix under Settings → Organization → Roles and permissions as the current source for available permissions.
Assign member roles
Section titled “Assign member roles”Open Settings → Organization → Membership, find the member, and select the appropriate roles.
Before removing an Owner role, confirm that another active Owner can recover organization access.
Create a custom role
Section titled “Create a custom role”Under Roles and permissions:
- choose Create role;
- enter a clear label and key;
- select the minimum permissions needed; and
- save the role before assigning it to members or service accounts.
You can use a built-in role as a starting point for customization.
Update or delete a custom role
Section titled “Update or delete a custom role”Review current assignments before deleting or changing a role. You can review role assignments in Settings → Organization → Membership.
Before deletion, move members and service accounts to another appropriate role.
Scope API keys
Section titled “Scope API keys”When creating an API key, choose either:
- a built-in or custom role; or
- an explicit set of permissions.
Prefer the narrowest access that can complete the automation. An API key remains bound to its organization and cannot use another organization ID to cross that boundary.
Recover from lost access
Section titled “Recover from lost access”If an action returns 403, confirm the active organization and the identity’s
current roles. Ask an Owner to restore the specific missing authority.