VibeControls uses a role-based access control system to determine what each workspace member can see and do. Roles are assigned per workspace, and each role grants a specific set of permissions across agents, vibes, sessions, notes, and other resources.
Roles Overview
There are three primary workspace roles in VibeControls:
| Role | Who It Is For |
|---|
| Viewer | Read-only access — can see resources but not modify or create them |
| Member | Regular contributor — can create and manage their own resources |
| Admin | Full control — can manage all resources and workspace settings |
Roles are assigned by an Admin when inviting someone to the workspace, or changed later through Workspace Settings → Members.
Permissions by Resource
Agents
| Operation | Viewer | Member | Admin |
|---|
| View agents list | Yes | Yes | Yes |
| View agent detail and health | Yes | Yes | Yes |
| View agent graph | Yes | Yes | Yes |
| Register a new agent | No | Yes | Yes |
| Edit agent name/description | No | Yes (own) | Yes |
| Delete an agent | No | No | Yes |
| Install/remove agent plugins | No | Yes (own) | Yes |
| View agent configurations | Yes | Yes | Yes |
| Edit agent configurations | No | Yes (own) | Yes |
Targets
| Operation | Viewer | Member | Admin |
|---|
| View targets | Yes | Yes | Yes |
| Create a new target | No | Yes | Yes |
| Edit target settings | No | Yes (own) | Yes |
| Delete a target | No | No | Yes |
| Open a terminal to a target | No | Yes | Yes |
| Import SSH hosts | No | Yes | Yes |
Vibes
| Operation | Viewer | Member | Admin |
|---|
| View vibes list | Yes | Yes | Yes |
| View vibe detail and notes | Yes | Yes | Yes |
| Create a new vibe | No | Yes | Yes |
| Edit vibe metadata | No | Yes (own) | Yes |
| Manage environment variables | No | Yes (own) | Yes |
| Archive a vibe | No | Yes (own) | Yes |
| Restore an archived vibe | No | Yes (own) | Yes |
| Delete a vibe | No | No | Yes |
| View vibe configurations | Yes | Yes | Yes |
| Edit vibe configurations | No | Yes (own) | Yes |
Sessions
| Operation | Viewer | Member | Admin |
|---|
| View sessions list | Yes | Yes | Yes |
| Open a session terminal (view) | Yes | Yes | Yes |
| Create a new session | No | Yes | Yes |
| Start/stop/restart own sessions | No | Yes (own) | Yes |
| Start/stop/restart any session | No | No | Yes |
| Delete session records | No | Yes (own) | Yes |
| Export session data | No | Yes | Yes |
| Share a session (direct) | No | Yes (own) | Yes |
| Generate session share links | No | Yes (own) | Yes |
| Bulk session operations | No | Yes (own) | Yes (all) |
Notes
| Operation | Viewer | Member | Admin |
|---|
| View notes | Yes | Yes | Yes |
| Create a note | No | Yes | Yes |
| Edit own notes | No | Yes | Yes |
| Edit any note | No | No | Yes |
| Pin a note | No | Yes | Yes |
| Tag a note | No | Yes | Yes |
| Delete own notes | No | Yes | Yes |
| Delete any note | No | No | Yes |
VibeDeck
| Operation | Viewer | Member | Admin |
|---|
| View VibeDeck layouts | Yes | Yes | Yes |
| Execute VibeDeck tiles (Command/Script) | No | Yes | Yes |
| Execute VibeDeck tiles (Webhook) | No | Yes | Yes |
| Create a VibeDeck | No | Yes | Yes |
| Edit own VibeDeck | No | Yes | Yes |
| Edit any VibeDeck | No | No | Yes |
| Delete a VibeDeck | No | Yes (own) | Yes |
| Share VibeDeck publicly | No | Yes (own) | Yes |
Webhooks
| Operation | Viewer | Member | Admin |
|---|
| View webhooks | Yes | Yes | Yes |
| Create a webhook | No | Yes | Yes |
| Edit a webhook | No | Yes (own) | Yes |
| Delete a webhook | No | Yes (own) | Yes |
| Test a webhook | No | Yes | Yes |
| View delivery logs | Yes | Yes | Yes |
Configurations
| Operation | Viewer | Member | Admin |
|---|
| View configurations (non-secret) | Yes | Yes | Yes |
| View secret configuration values | No | No | Yes |
| Create configurations | No | Yes | Yes |
| Edit configurations | No | Yes (scoped to own resources) | Yes |
| Delete configurations | No | Yes (scoped to own resources) | Yes |
Tunnels / Port Forwards
| Operation | Viewer | Member | Admin |
|---|
| View tunnels | Yes | Yes | Yes |
| Create a tunnel | No | Yes | Yes |
| Pause/resume own tunnel | No | Yes | Yes |
| Delete own tunnel | No | Yes | Yes |
| Delete any tunnel | No | No | Yes |
| Generate public tunnel link | No | Yes (own) | Yes |
Workspace Settings
| Operation | Viewer | Member | Admin |
|---|
| View workspace settings | Yes | Yes | Yes |
| Edit workspace name and details | No | No | Yes |
| Manage members | No | No | Yes |
| Invite new members | No | No | Yes |
| Change member roles | No | No | Yes |
| Remove members | No | No | Yes |
| Manage workspace configurations | No | No | Yes |
| View audit log | No | No | Yes |
Understanding "Own" Resources
In the table above, "Yes (own)" means the member can perform this action only on resources they created. For example, a Member can edit the vibes they created, but not vibes created by another member. Admins can edit any resource regardless of who created it.
Checking Your Own Permissions
To see what role you have in a workspace:
- Go to Workspace Settings → Members
- Find your name in the member list
- Your role is shown in the Role column
How Roles Are Assigned
Only Admins can assign or change roles:
- Go to Workspace Settings → Members
- Find the member
- Click the role dropdown next to their name
- Select the new role
Changes take effect immediately.
Inviting New Members
To invite someone to the workspace:
- Go to Workspace Settings → Members
- Click Invite member
- Enter their email address
- Choose their initial role
- Click Send invitation
The invitee receives an email with a link to join. They must create an account (or sign in) to accept.
Feature Gating
Some features in VibeControls are controlled by feature flags in addition to roles. If you are an Admin but a feature is not visible, it may be gated at the plan or workspace level. Contact your workspace owner or VibeControls support if you believe you should have access to a feature that is not visible.