Capy Roles: Owner, Admin, Project Admin, Member

Capy has four org-level roles. The first three are chosen at invite time; Owner is implicit - the person who created the org.

Role	What they can do
Owner	Everything. Creator of the org. Holds the seed phrase. Cannot be kicked.
Admin	Invite, kick, manage any project, create projects, manage billing.
Project Admin	Manage projects they own: create branches, invite to specific projects, but not manage the whole org.
Member	Read and write secrets in org-wide branches they have access to.

Choosing a role at invite time

capy invite alice@example.com

Capy prompts:

? What role should alice@example.com have?
  ❯ Member
    Project Admin
    Admin

Changing roles after the fact

capy users opens an interactive members list - Capy’s TUI for inspecting and editing roles in the org. Press r on a row to change that user’s role, Enter to expand a member and see their per-project roles and protected-branch grants.

  Organization Members (3 users)

  Email                          Role           Added         Projects
  ─────────────────────────────────────────────────────────────────────
> alice@acme.com                 owner          2025-01-15    2 projects
  bob@acme.com                   member         2025-02-03    1 project
  carol@acme.com                 admin          2025-03-10    2 projects
  ─────────────────────────────────────────────────────────────────────
   ↑↓ navigate  Enter expand/collapse  r change role  g grant protected  q quit

When you press r, an inline picker replaces the role cell with the available options. Pick one and the change applies immediately.

  Email                          Role           Added         Projects
  ─────────────────────────────────────────────────────────────────────
  alice@acme.com                 owner          2025-01-15    2 projects
> bob@acme.com                   ❯ admin                      1 project
                                   project-admin
                                   member
  ─────────────────────────────────────────────────────────────────────
   ↑↓ pick role  Enter confirm  Esc cancel

Expanding a member with Enter shows the projects they belong to plus any protected branches they hold a grant on, and lets you change their per-project role from the same view.

Protected branches narrow access further

Org-level role and protected-branch membership are two separate things. An Admin doesn’t automatically have access to every protected branch - they still need to be granted access to each protected branch individually. The org role controls who can invite; protected-branch membership controls who can decrypt.

Getting started

Using Capy

Deploying

Organizations

Branches

Team

CLI reference

Under the hood

Comparisons

Capy Roles: Owner, Admin, Project Admin, Member

Choosing a role at invite time

Changing roles after the fact

Protected branches narrow access further

What’s next

Inviting users

Protected branches

​Choosing a role at invite time

​Changing roles after the fact

​Protected branches narrow access further

​What’s next

Inviting users

Protected branches

Choosing a role at invite time

Changing roles after the fact

Protected branches narrow access further

What’s next