Skip to main content
This is the detailed capability reference for Origin’s eight built-in roles. It exists to answer one question precisely: if I grant someone this role, what can they reach? For how grants work, how to invite users, and guidance on choosing between roles, see User Management.

​
The eight roles

These are the names as they appear in the role picker in Settings → User Management. Every role applies across the whole tenant. Nothing about a role is implicit — if a capability isn’t granted below, that role can’t reach it.

​
Data-facing roles

Five roles work with monitored data. Legend: ✓ full access · ◐ read-only or limited · — no access
Detection Engineer is the only non-admin role that reads AI prompt text, raw event payloads, and directory PII. Everything SecOps can do, it can do — plus the content needed to write and tune detections.

​
Operational and limited roles

These three are defined by what they can’t reach, so they’re listed separately rather than as mostly-empty columns.

​
Sensitive surfaces

Every analytics column is classed Default or Sensitive. Default covers metadata — timestamps, model names, identifiers, counts, status. Sensitive covers anything that exposes private content in bulk, and reading it requires a dedicated permission on top of the role’s normal read. A query that references a sensitive column — in a result, a filter, a grouping, or a sort — without the matching permission is refused before it runs. A role that can’t read a sensitive column never even sees it in the schema, so it can’t build a query that touches one, and it can’t probe values by guessing.
AI prompt text is treated as the most sensitive surface in the product. Grant Detection Engineer to people who tune detections — not as a general power-user role.
For the exact permission strings behind any capability not listed above, contact Origin support.