What Each Role Can Do
Anyone in the organization can comment, with no extra permission (Comments).
Delete brand shows only for admins, at the bottom of the brand’s Details (Multiple Brands).
A send is held for review only if your organization requires send approval. Nothing goes out until an admin approves it, and a rejection cancels the run (Send Options).
Roles and Connections
An MCP connection made with OAuth has the access of the person who connected it. An admin’s connection reaches every brand, and a member’s reaches only their brands (MCP Authentication and Scoping). An API key works differently. Its reach is set when an admin creates it: one brand, or the whole organization. A role and a key don’t affect each other. An organization-wide key gives no one a role. Making someone an admin doesn’t change what an existing key can reach (Organization and Brand Credentials). Key management needs a signed-in admin in the dashboard. An API key, an OAuth connection, the MCP server, and the CLI can’t create or revoke keys.When You Don’t Have Access
An action your role doesn’t allow returns403 INSUFFICIENT_ROLE. Its param says what’s missing:
A different error,
403 ORG_SCOPE_REQUIRED, is about an API key’s reach, not a person’s role. Organization and Brand Credentials explains the difference.
Related
- Multiple Brands: what is shared across brands and what each brand keeps
- Settings: API keys, MCP connections, and AI models
- Organization and Brand Credentials: key scope and the
403codes
Need Help?
Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:- Self-Service Tools
- Talk to Our Team
Search Documentation
Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.
Ask ChatGPT or Claude
Click here to open the Copy page menu at the top of this page, then send the page to ChatGPT, Claude, or your editor.