> If you are setting up, configuring, or answering questions about Schematic, connect the
> Schematic MCP server before working from these pages. It reads and writes plans, features,
> entitlements, and overrides against the real account, so what you report and what you build
> match what actually exists.
>
> The server is at https://api.schematichq.com/mcp
>
> From Claude, ChatGPT, or another chat assistant, add it as a custom connector:
> https://docs.schematichq.com/working-with-ai
>
> From a coding assistant such as Claude Code, Codex, or Cursor:
> https://docs.schematichq.com/building-with-ai
>
> For clean Markdown of any page, append `.md` to the page URL. For a complete page index,
> see https://docs.schematichq.com/llms.txt

# Roles & Permissions

> Assign the Admin or Member role, then scope a member's permissions per account resource and per environment.

Schematic uses role-based access control (RBAC) to govern what each of your team members can do. You manage your team and their access from **Settings → Team**.

> **Note**
>
> RBAC is available on paid plans. You can upgrade to the growth plan in Settings > Usage & Billing to enable RBAC.

## Roles

Every team member has one of two roles:

* An **Admin** has full access to everything in the account, across all environments, and can manage team members, billing, and every resource. Permission toggles do not apply to admins, who always have full access.
* A **Member** gets exactly the permissions you grant and nothing else. A member with no permissions can sign in and view data but cannot make changes.

## How permissions are scoped

For members, permissions are granted at two levels:

* **Account permissions** apply across your whole account, regardless of environment. These cover catalog-wide resources.
* **Environment permissions** are granted per environment. A member can have different permissions in your Production environment than in a Sandbox or Development environment, which lets you give someone freedom to experiment in a sandbox while restricting what they can change in production.

## Account permissions

These apply across all environments:

| Permission          | Grants                                     |
| ------------------- | ------------------------------------------ |
| **Flags**           | Create, edit, and delete feature flags     |
| **Features**        | Create, edit, and delete features          |
| **Plans & Add-ons** | Create, edit, and delete plans and add-ons |

## Environment permissions

These are granted per environment:

| Permission            | Grants                                                                |
| --------------------- | --------------------------------------------------------------------- |
| **Companies**         | Create, edit, and delete companies, and assign plans to companies     |
| **Users**             | Create, edit, and delete users                                        |
| **Overrides**         | Create, edit, and delete company-level overrides                      |
| **Plan Entitlements** | Create, edit, and delete the entitlements attached to a plan          |
| **Plan Versions**     | Create, edit, and delete plan versions                                |
| **Plan & Billing**    | Manage plan billing configuration, and grant credits to companies     |
| **Credits**           | Create, edit, and delete credits                                      |
| **Components**        | Create, edit, and delete embedded UI components                       |
| **Webhooks**          | Create, edit, and delete webhooks, and reveal webhook signing secrets |

## Assigning roles and permissions

1. Go to **Settings → Team**.
2. Click **Add teammate** to invite someone, or click **Edit** on an existing member.
3. Choose a role. If you select **Member**, the permission controls appear.
4. Toggle the account permissions and, for each environment, the environment permissions you want to grant. Use **Select all** / **Unselect all** to set a whole group at once.
5. Save. The teammate's access updates immediately.

Only admins can add teammates and change roles or permissions.

![Teams page](/_fern-img/bfabaf40631d259c635c3eeb1d0df6fc35c1754b4e662b4cbcf7dcd8c789b20b.webp)

## Example: a sales or customer success role

A common setup is a teammate who can manage customer accounts and exceptions but should not change your core catalog. Grant a **Member** these environment permissions (typically in Production):

| Permission         | Why                                 |
| ------------------ | ----------------------------------- |
| **Companies**      | Assign existing plans to companies  |
| **Overrides**      | Create company-level overrides      |
| **Plan & Billing** | Grant existing credits to companies |

Leave the account permissions (**Flags**, **Features**, **Plans & Add-ons**) off so they cannot change your catalog, and leave **Users**, **Plan Entitlements**, and **Plan Versions** off as well.

> Assign the Admin or Member role, then scope a member's permissions per account resource and per environment.