Capy Roles: Owner, Admin, Project Admin, Member

Capy has four org-level roles. Three of them - Admin, Project Admin, and Member - are chosen at invite time; Owner is implicit, the person who created the org.

Role	What they can do
Owner	Everything, including every branch in every project. Holds the seed phrase, and is the only role that can run `capy decrypt`. There is exactly one owner per org and the role can’t be reassigned.
Admin	Org-wide access, including every branch. Invites at any role up to Admin, and changes any non-owner role.
Project Admin	Full access to the projects they administer, including every branch in them. Invites Members and other Project Admins, but not Admins, and can’t change an Admin’s or the Owner’s role.
Member	Scoped to the projects they’re assigned. Reads and writes the unprotected branches in those projects, plus any protected branch they’ve been granted individually.

Choosing a role at invite time

capy invite alice@example.com

Capy prompts:

? Select a role for alice@example.com: (Use arrow keys)
❯ Member
  Project Admin
  Admin

The list only offers roles you’re allowed to grant, so a Project Admin sees Member and Project Admin but never Admin. To skip the prompt, pass the role on the command line:

capy invite alice@example.com --role project-admin

Changing roles after the fact

capy users opens an interactive members list - Capy’s TUI for inspecting and editing roles in the org. Press r on a row to change that user’s role, Enter to expand a member and see the projects they belong to.

  Organization Members (3 users)

  Email                             Role               Added          Projects
  ────────────────────────────────────────────────────────────────────────────
  ▸ alice@acme.com                  owner              2025-01-15     2
    bob@acme.com                    member             2025-02-03     1
    carol@acme.com                  admin              2025-03-10     2
  ────────────────────────────────────────────────────────────────────────────

   ↑↓ navigate  Enter expand/collapse  r change role  g toggle branch access  q quit

When you press r, the role cell turns into an inline picker showing one role at a time. ↑↓ cycles through the roles you can assign - admin, project-admin, member - and Enter confirms.

  Email                             Role               Added          Projects
  ────────────────────────────────────────────────────────────────────────────
    alice@acme.com                  owner              2025-01-15     2
  ▸ bob@acme.com                    ◆ admin            2025-02-03     1
  ────────────────────────────────────────────────────────────────────────────

   ↑↓ pick role  Enter confirm  Esc cancel

Picking admin applies straight away. Picking project-admin or member is project-scoped, so Capy opens a project picker first - Space to select, Enter to confirm - and assigns the role on exactly the projects you check, dropping the ones you uncheck. You can’t change your own role, and nobody can change the Owner’s. A Project Admin can’t act on an Admin or the Owner either. Expanding a member with Enter lists the projects they belong to; owners and admins collapse to a single Access to all branches line instead. Press r on a project row to set their role on just that project (project-admin, member, or none to remove them), or Enter on it again to expand that project’s branches.

Protected branches narrow access further

Org-level role and protected-branch grants are two separate things, but grants only apply to Members. Owners and admins already reach every branch in the org, and a project admin reaches every branch in the projects they administer - in capy users all of them show as Access to all branches or access granted, with nothing to toggle. Grants matter for someone whose role on a project is member. They reach the unprotected branches in that project, and every protected branch has to be granted one at a time - with g on a branch row in capy users, or non-interactively:

capy grant-branch bob@acme.com my-project production
capy revoke-branch bob@acme.com my-project production

Both take the member’s email, the project name, and the branch name.

What’s next

Inviting users

The redeem-code flow.

Protected branches

Per-branch access lists.

Getting started

Using Capy

Deploying

Organizations

Branches

Team

CLI reference

Under the hood

Comparisons

Capy Roles: Owner, Admin, Project Admin, Member

Choosing a role at invite time

Changing roles after the fact

Protected branches narrow access further

What’s next

Inviting users

Protected branches

​Choosing a role at invite time

​Changing roles after the fact

​Protected branches narrow access further

​What’s next

Inviting users

Protected branches

Choosing a role at invite time

Changing roles after the fact

Protected branches narrow access further

What’s next