Permissions

JuhJuh controls access at four levels: organization, project, knowledge (folders and pages), and teams. Your subscription plan determines which features are available.

Organization roles¶

Every organization member has one of three roles: Owner, Admin, or Member.

Owner has full control over the organization, including billing and destructive operations. Only owners can promote members to admin.

Admin can manage most resources but cannot access billing or perform destructive organization operations. Admins can invite members and change roles, except promoting someone to admin.

Member can create and view projects. All other management actions require admin or owner access.

Project roles¶

Within each project, members are assigned one of four roles: Owner, Admin, Member, or Viewer.

Owner has full project control, including deletion.

Admin can manage members, settings, and resources but cannot delete the project.

Member can create and execute tickets.

Viewer has read-only access to tickets.

Knowledge permissions¶

Pages are organized into folders. Access is controlled at both the folder and page level.

Folder roles¶

Each folder has a visibility mode: Public or Private. Public folders are visible to all project members. Private folders require explicit membership.

Folder members have one of three roles:

Project admins can access and manage all folders regardless of membership.

Page-level overrides¶

Individual pages can have their own permission entries, independent of the folder they belong to. Page permissions use three levels:

• Admin: can manage who has access to the page
• Edit: can read and modify the page
• View: read-only access

When a page has explicit permission entries, only users listed (plus folder owners and project admins) can access it. When no explicit permissions are set, the page inherits access from its folder. For pages in public folders with no overrides, all project members can read and edit.

The page creator and any user with the Admin permission level can add or remove other users' access.

Team roles¶

Teams are project-level groups used to organize members by function (Backend, Frontend, DevOps, and so on). Each team member has one of two roles:

• Lead: can approve review comments on tickets assigned to team members
• Member: standard team participation

Team leads have the same project permissions as their project role. The Lead designation adds review authority: leads can save review comments on any ticket within their team's scope, alongside the ticket's assignee and project admins.

Vault secret visibility¶

All organization members can list vault entries and see entry names. Secret values are masked by default.

Only Owners and Admins can reveal secret values. To reveal a secret, the user must be an Owner or Admin and explicitly request the unmasked value. Regular members always see masked values.

Through the CLI, the same rules apply: vault get returns masked values unless the authenticated user has Admin or Owner access and passes the reveal flag.

Inviting members¶

1. Go to Settings > Members
2. Click Invite Member
3. Enter their email address
4. Select an organization role (Admin or Member)
5. Click Send Invite

The invited user receives an email and joins your organization after accepting.

Changing roles¶

A few constraints apply when changing roles:

• Only Owners can promote members to Admin
• Owners and Admins can change other members' roles, within their authority
• No one can change their own role
• The Owner role cannot be reassigned through the members panel

API and CLI access¶

API authentication uses organization-scoped keys. Each key is tied to a single organization and carries the permissions of the user who created it.

When using the CLI, your session inherits your organization role. Users who belong to multiple organizations can switch context with juhjuh org set or by passing the organization header on each request.

The MCP server follows the same permission model as the API. Your MCP session inherits the permissions of the connected account.

Subscription-gated features¶

Your subscription plan determines which features are available to your organization.

When a feature is gated by your plan, the corresponding UI options are hidden or show an upgrade prompt.

Related¶

• Billing: subscription plans, token usage, and feature limits
• Projects: create and manage projects, assign member roles
• Agents: configure AI agents (requires Admin or Owner at the org level)
• Pages: knowledge base with folder and page-level permissions
• Infrastructure Overview: manage cloud resources (requires Admin or Owner)
• Vault: store and manage secrets with role-based visibility
• Teams: organize members by function with Lead and Member roles