Guide
Roles and permissions
Every member of a Logthread workspace has one role: Viewer, Member, Admin or Owner. Each role includes everything the one before it can do. The table below is the whole matrix, what each role can do in the app and how an AI agent reaches the same action through MCP. It is generated from the same lists the app and the MCP server use, and a test fails when they disagree, so it cannot drift.
The role matrix#
| What | Viewer | Member | Admin | Owner | Through MCP (tool, API-key scope) |
|---|---|---|---|---|---|
| Read Explore, live tail, patterns, traces, metrics, the service map, dashboards, alerts and usage | Yes | Yes | Yes | Yes | Read tools (scope read) |
| Create and revoke ingest keys | No | Yes | Yes | Yes | create_ingest_key, revoke_ingest_key (scope sources). The key's creator must also be Member or higher |
| Run SQL and KQL and read the slow-query log | No | Yes | Yes | Yes | run_sql (scope sql). The key's creator must also be Member or higher |
| Export results | No | Yes | Yes | Yes | UI only |
| Build dashboards | No | Yes | Yes | Yes | create_dashboard, add_dashboard_panel, update_dashboard_panel, set_dashboard_variables, set_dashboard_refresh, import_grafana_dashboard, delete_dashboard, delete_dashboard_panel (scope dashboards). The key's creator must also be Member or higher |
| Create alert rules and acknowledge incidents | No | Yes | Yes | Yes | create_alert_rule, create_slo, update_slo, preview_alert_rule, update_alert_rule, delete_alert_rule, delete_slo (scope alerts). The key's creator must also be Member or higher |
| Turn searches, traces, patterns, metrics and parsed fields into panels and alerts | No | Yes | Yes | Yes | UI only |
| Share saved searches | No | Yes | Yes | Yes | save_search, delete_saved_search (scope dashboards). The key's creator must also be Member or higher |
| Set service owners, merge names and record what happened in incidents | No | Yes | Yes | Yes | set_service_owner (scope alerts). The key's creator must also be Member or higher |
| Add chart annotations | No | Yes | Yes | Yes | create_annotation, delete_annotation (scope annotate). The key's creator must also be Member or higher |
| See collectors, pipelines and integrations | No | Yes | Yes | Yes | list_pipelines, get_pipeline, list_fleet, list_sources, list_integrations, get_integration (scope read). The key's creator must also be Member or higher |
| Invite and remove people and change roles | No | No | Yes | Yes | UI and REST API only; MCP has read-only list_team_members (scope read) |
| Manage API keys and connect AI agents | No | No | Yes | Yes | UI only; an API key cannot create or revoke API keys |
| Edit pipelines, routes and redaction | No | No | Yes | Yes | create_pipeline, preview_pipeline, update_pipeline, activate_pipeline, set_redaction, delete_pipeline (scope pipelines). The key's creator must also be Admin or higher |
| Manage alert channels | No | No | Yes | Yes | create_alert_channel, test_alert_channel, delete_alert_channel (scope alerts). The key's creator must also be Admin or higher |
| Manage collector configs and rollouts | No | No | Yes | Yes | create_fleet_config, activate_fleet_config, delete_fleet_config (scope fleet). The key's creator must also be Admin or higher |
| Connect integrations | No | No | Yes | Yes | add_integration, connect_livekit (scope sources). The key's creator must also be Admin or higher |
| See billing and request plan changes | No | No | Yes | Yes | UI only; MCP has read-only get_usage_summary (scope read) |
| Read the audit log | No | No | Yes | Yes | UI only |
| Set the time zone and parsing | No | No | Yes | Yes | UI only |
| See which members have two-factor on | No | No | Yes | Yes | UI only |
| Edit and delete any chart annotation | No | No | Yes | Yes | UI only |
| Change data retention | No | No | No | Yes | UI only |
| Turn on the archive | No | No | No | Yes | UI only |
| Delete the workspace | No | No | No | Yes | UI only |
| Configure single sign-on and SCIM | No | No | No | Yes | UI and REST API only; SCIM is for your identity provider, not for agents |
| Manage the AI assistant | No | No | No | Yes | UI only |
| Require two-factor for everyone | No | No | No | Yes | UI only |
| Buy extended retention | No | No | No | Yes | UI only |
Read-only MCP tools#
| Key scope | Read-only tools (the key's creator only needs to be an active member) |
|---|---|
read | list_services, check_instrumentation, search_logs, count_logs, top_values, list_fields, get_log_context, get_story, find_request, get_flows, explain_step, compare_failing, list_linking_fields, list_patterns, search_traces, get_trace, list_metrics, query_metric, list_alerts, list_saved_searches, list_annotations, what_changed, who_is_failing, get_service_owners, investigate_incident, search_docs, get_doc, list_docs, validate_query, ltql_grammar, topology_downstream, topology_upstream, topology_shared_dependencies, topology_downstream_patterns, topology_diff, topology_incident_clusters, get_setup_checks, list_dashboards, get_dashboard, get_alert_rule, get_incident, get_channel, get_usage_summary, list_team_members, list_alert_channels, list_slos |
How MCP follows the roles#
- A key needs a scope and a person. An API key is allowed a tool by its scope (
read,sql,annotate,alerts,dashboards,pipelines,fleet,sources). A tool that changes something, or runs SQL, also acts as the person who created the key, and that person's current role must reach the role in the table. Both checks apply, and the stricter one wins. - The role is checked at the moment of the call. If the creator is demoted, the tools that need the higher role start refusing at once, with a message that names the role. If the creator is removed from the workspace, the keys they created are revoked with the membership and stop working immediately. A SCIM deactivation does the same.
- Agents cannot manage people. Inviting, removing and changing the role of a member, SSO and SCIM setup, API keys and the audit log are UI and REST API only, and the REST routes take a signed-in person, not an API key: a key sent to them is refused with 401. MCP has one read-only tool,
list_team_members, that lists members with their roles and pending invitations. - Connected apps (Claude, ChatGPT and other OAuth connections) act as the person who connected them, within that person's role, with the same table.
- Everything is audited. Each call is an
mcp.tool_call, and every change is in the audit log under the person's name withvia: mcpand the key.
Who can change whom#
- Admins can change or remove only members ranked below them, and can assign only roles below their own.
- Owners can change anyone, including promoting another owner, and a workspace always keeps at least one owner.
- With single sign-on, group mapping can assign Viewer, Member or Admin. It never grants Owner and never changes an owner. Owners keep password access when SSO is enforced (break-glass), and every such sign-in is audited.
See also Team, usage and billing for invitations and the audit log, and Single sign-on for SAML, OIDC and SCIM.