Set up Operations access and permissions
Give operators the capabilities their job requires and verify the actual actions.
Operations supports company administration, connected services, resources, and operational oversight. Give people access based on the work they perform, then configure the relevant capabilities.
Who configures this: an Owner or Admin in Team. Owners and Admins have broad Operations access and bypass granular scopes.
Configure an operator
- Open Team and select the member.
- Confirm their organization role meets the minimum for the feature.
- Enable Operations in their area access.
- Review the Operations permissions and select the required scope levels.
- Wait for changes to save, then test the intended page and action with the operator’s account.
A scope is one part of authorization. Area access, minimum role, enabled modules, and action-specific checks can also apply.
Review the scope families
| Capability | Available scope pattern | Practical meaning |
|---|---|---|
| Library | None, View, Manage | Controls supported Library reading or management. |
| Integrations | None, View, Edit | Controls supported integration visibility and changes. |
| Audit log | None, View | Adds the scoped permission to review history when the organization role also permits it. |
| Secrets | None, View, Edit | Does not override the Secrets page’s Admin minimum role. |
| n8n sync, migration, rotation | Separate action permissions | Review each action independently; the controls depend on integration editing permission. |
| Delete access | Separate permission | Enables applicable destructive actions; it is not a universal override for every delete button. |
| Registry access | Resource-access setting | Review which Registry content the person should use. |
Understand role limits
The reviewed implementation requires at least Member to enter Integrations and Audit, and at least Admin for Secrets. A permissive-looking scope on a lower organization role does not override those minimums. Viewers remain read-only.
Some integration actions are more restricted than editing the page. In particular, provider disconnect controls can require Admin. Test the actual action the operator needs instead of judging access from a navigation item alone.
Review n8n capabilities together
Integration editing permission is a prerequisite for the n8n action controls. Reducing Integrations from Edit clears the n8n sync, migration, and rotation permissions in the editor. If you later restore Edit, review the individual actions again instead of assuming the previous configuration returned.
Keep operational administration deliberate
An everyday team member may need Spaces without any Operations access. A specialist may need Operations and only a small number of shared projects. A resource-level Manager in Spaces does not automatically become a company administrator.
Recheck scopes when responsibilities change, when adding a connected service, and before granting actions that remove resources or rotate credentials. Record the intended job and test result so the next administrator can understand why the access exists.