Roles and permissions
See what Admins, Members, and Managers can see and do in Tokenize, and how each role is assigned.
What you see in Tokenize depends on your role. Admins see the whole organization and manage settings. Members see their own usage. Managers are members who can also manage team settings for the people who report to them.
The roles
Admin. Sees organization-wide usage and manages the workspace: providers, API keys, devices, integrations, directory sync, privacy, budgets, models, MCP servers, and alerts. The person who creates the workspace is its first Admin. Admins land on the organization Overview when they sign in.
Member. Sees their own usage, sessions, and guidance, and can enroll their own computers. Members land on My Usage when they sign in. They don't see other people's usage or organization-wide totals.
Manager. Not a role you assign. A Member becomes a Manager automatically when your directory shows they have at least one direct report. Tokenize reads manager relationships from your identity provider through directory sync. A Manager can do everything a Member can, plus manage team budgets, team guidance, and team skills, and see alert history, for their reporting line (their direct reports and everyone below them). If their last report leaves, they lose that access.
You assign Admin or Member in Settings → Organization → Members. See Invite your team.
What each role sees
| Page | Admin | Manager | Member |
|---|---|---|---|
| Overview | Whole organization | — | — |
| Sessions | Everyone, with team and user filters, including Top Cost | Their own | Their own |
| Users | Everyone | — | — |
| Engineering | Yes | — | — |
| Platform Usage | Yes | — | — |
| Alerts | View and manage | Alert history for their teams | — |
| Opportunities | Yes | — | — |
| Skills | View and manage | Manage skills for their teams | — |
| Plugins | Yes | — | — |
| Guidance | Organization and any team | Their teams and their own | Their own |
| Budgets | View, and set any team's budget | View, and set budgets within their reporting line | View |
| Models | View and manage | View | View |
| MCP Servers | Organization view, and manage | Their own view | Their own view |
| My Usage | Yes | Yes | Yes |
Settings by role
| Settings tab | Admin | Manager and Member |
|---|---|---|
| Account | Yes | Yes |
| Organization | Manage members and invitations | View |
| Downloads | Yes, including MDM Deployment | Yes |
| My devices | Yes | Yes |
| API keys, Providers, Provider aliases, Integrations, Directory Sync, Privacy | Yes | — |
If you open a page your role can't reach, Tokenize sends you to My Usage.
Change someone's role
- Go to Settings → Organization and open the Members tab.
- Find the person and change their role to Admin or Member.
The change applies the next time their session refreshes. To make someone a Manager, update their manager relationship in your identity provider. It flows into Tokenize through directory sync.