Create an organization role

Create and manage organization roles to delegate access to Retool administrative settings without granting full admin privileges.

Use organization roles to delegate access to specific Retool settings, such as SSO configuration, billing, or user management, without granting full admin privileges. For example, you can give a finance team access to billing while keeping the rest of the admin panel off-limits.

Only organization admins can create, modify, and delete roles. Roles are created and managed the same way on both Business and Enterprise plans.

Create an organization role

Organization role creation is a two-step process: first name the role, then select its permission scopes.

1. Navigate to Settings > Roles.
2. Click the Create Role dropdown.
3. Under Role details enter a Name and optional Description for the role (for example, SSO Manager or Billing Administrator).
4. Select the permission scopes to include. Scopes are grouped by category. You can search by keyword, filter by category type, or use Select all / Deselect all within a section. The Permissions preview pane updates as you make selections.
5. Click Save changes.

Create focused roles with only the minimum permissions needed. You can assign multiple roles to a group so members receive the combined permissions of all assigned roles.

Permission scopes

Scopes are organized into the following categories. Available scopes differ by plan: Business plans include non-sensitive settings, while Enterprise adds sensitive admin functions. See Admin permissions for the full list.

• User management: User attributes, custom SSO, account details, user list.
• Query library: View and edit the query library.
• Organization: Spaces, source control, usage analytics, billing, audit logs.
• Customization: Branding, themes, custom components, Retool events.
• Configuration: Environments, configuration variables, Retool AI, IAM credentials, observability, mobile settings.
• Assist: View and edit Assist.
• Updated app builder: Build React apps in the new app builder.

Manage an organization role

From the role's detail page in Settings > Roles, you can edit its permission scopes or use the Manage dropdown to rename it or delete it.

Edit role details

1. Navigate to Settings > Roles and select the role.
2. Click on the name of the role.
3. Update the selected scopes, or change the name and description as needed.
4. Click the Assignment tab to manage the groups assigned to the role.
5. Click Add group assignment, select additional groups from the dropdown and click Add.
6. Click Save changes.

Changes apply immediately to all groups assigned the role.

Delete a role

1. Navigate to Settings > Roles and select the role.
2. Click Manage and select Delete.
3. Confirm the deletion.

Default roles (such as Admin) cannot be deleted or edited.