---
source_url: https://www.pubnub.com/docs/security/admin-portal-roles
title: Admin Portal roles
description: The roles you can assign to members of a PubNub organization in the Admin Portal, what each role permits, and which roles can't be combined.
updated_at: 2026-09-30T07:20:08.000Z
---

# Admin Portal roles

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

The Admin Portal uses role-based access control for members of a PubNub organization. A role sets what a member can see and change in the [Admin Portal](https://admin.pubnub.com/), such as apps, keysets, secret keys, usage, and [Functions](https://www.pubnub.com/docs/message-processing/serverless/overview.md). Roles don't affect what your app's clients can do on channels. [Access Manager](https://www.pubnub.com/docs/security/access-control/overview.md) controls that through tokens.

You assign a role when you [invite an organization member](https://www.pubnub.com/docs/security/invite-organization-members.md).

:::note Account Owner
Every organization has one Account Owner: the user who created the organization. The Account Owner has the same access as Account Admin and cannot be removed, reassigned, or managed through the Members tab.
:::

## Roles

| Role | Permissions |
| --- | --- |
| **Account Admin** | Full control over the account. Can create, update, and delete secrets. |
| **Account Viewer** | View all apps and keysets (secret keys excluded). Observe account-wide usage. Cannot modify apps, keysets, or account settings. |
| **App Admin** | All App Viewer permissions. All Functions Developer permissions. Modify app and its keysets. Create, view, and edit Functions Deployments at the app level. |
| **App Viewer** | All Functions Viewer permissions. Access app. View keys (secret key excluded). Observe app usage. View Functions Deployments at the app level. |
| **Key Admin** | All Key Viewer permissions. All Functions Developer permissions. Modify keyset. Create, update, and delete secrets. Create, view, and edit Functions Deployments at the keyset level. |
| **Key Viewer** | All Functions Viewer permissions. Access keyset information (secret key excluded). Observe keyset usage. View Functions Deployments at the keyset level. |
| **Business Insights** | View [Insights](https://www.pubnub.com/docs/analytics/usage-dashboards/overview.md) dashboards and edit dashboard settings. No access to app or keyset settings. Formerly named PubNub Insights. |
| **BizOps Dashboard Operator** | Manage members, memberships, channels, channel memberships, and [presence](https://www.pubnub.com/docs/presence/overview.md) rules for a keyset. No access to other Admin Portal sections. Formerly named BizOps Objects Operator. |
| **Illuminate Admin** | View, create, and edit Business Objects, Dashboards, and Decisions in [Illuminate](https://www.pubnub.com/docs/analytics/decisions/overview.md). No access to other Admin Portal sections. |
| **Functions Developer** | Create, edit, and delete packages and Functions across the entire account. Cannot be assigned alongside Account Admin. |
| **Functions Viewer** | View Functions code and deployments across the entire account. Cannot be assigned alongside Account Admin. |

## Mutually exclusive roles

A member can hold more than one Admin Portal role, except for the combinations in this table.

| Role | Cannot be combined with |
| --- | --- |
| **Account Admin** | App Admin, App Viewer, Account Viewer, Key Admin, Key Viewer, Business Insights, BizOps Dashboard Operator, Functions Viewer, Functions Developer, Illuminate Admin |
| **Account Viewer** | Account Admin, App Admin, App Viewer, Key Admin, Key Viewer |
| **App Admin** | Account Admin, App Viewer (same app), Key Admin (same app), Key Viewer (same app) |
| **App Viewer** | Account Admin, App Admin (same app), Key Viewer (same app) |
| **Key Admin** | Account Admin, App Admin (same app), Key Viewer (same keyset) |
| **Key Viewer** | Account Admin, App Admin (same app), App Viewer (same app), Key Admin (same keyset) |
| **Business Insights** | Account Admin |
| **BizOps Dashboard Operator** | Account Admin |
| **Functions Developer** | Account Admin, Functions Viewer |
| **Functions Viewer** | Account Admin, Functions Developer |
| **Illuminate Admin** | Account Admin |

## Related pages

* [Invite organization members](https://www.pubnub.com/docs/security/invite-organization-members.md). Invite a member and assign one of these roles.
* [Audit log](https://www.pubnub.com/docs/security/audit-log.md). See who added or revoked a role, and when.
* [Permission model](https://www.pubnub.com/docs/security/access-control/permission-model.md). The Access Manager permissions your app's clients receive through tokens.

Last updated at: 2026-09-30T07:20:08.000Z