Roles & permissions

heliana uses a role-based permission system. Every member has one role; the role determines which actions they can perform. Two built-in system roles are always present. You can create additional custom roles and tune their permissions through the roles matrix — every organization is also seeded with one custom role named Moderator at creation, linked to six moderation Actions buttons: five player buttons (Ban, Warn, Kick, Remove from squad, Force team change) and Broadcast on the server panel.

Built-in (system) roles

Role	Description
Owner	The organization creator. Holds every key in the matrix. Not offered by the invite dialog; the Owner transfers ownership from the Members table: assigning Owner to another member makes the previous Owner an Admin. There is exactly one Owner, who can be neither removed nor demoted.
Admin	Holds every key except `organization:delete` — deleting the organization and billing (checkout, portal, number of servers) are Owner only. Fixed in the system matrix.

System roles are fixed — their checkboxes are not editable, for any permission group, including the Automation actions rows.

Create a custom role

In Settings → Roles, click New role.
Enter a Name (for example, “Support”) and click Create.

The new role starts with all permissions unchecked. Grant permissions by editing the matrix (see below).

Edit permissions in the matrix

The matrix lists every permission key in rows grouped by resource (Bans, Ban lists, Players, Automations, etc.). Columns represent roles.

On the Roles page, click Edit. Checkboxes activate for all custom role columns.
Check or uncheck permissions for each custom role as needed, then Save, or Cancel to discard changes.

System role columns (Owner, Admin) remain locked during editing.

Delete a custom role

Delete the custom role from the matrix and confirm.

A role that still has members is not deleted. The delete is refused, and the Roles page reports how many members still hold it — move them to another role first, then delete. Deleting a role that nobody holds also cancels any pending invitation that was issued with that role.

Permission groups in the matrix

The matrix organizes permissions into the following groups:

Access lists — read and manage access lists: their entries, and who leads them
Audit log — read the audit log; entries about a server are narrowed by your server access
Bans — create and read bans, and revoke (delete) them; update is defined but not wired to any route yet
Ban lists — ban exceptions on a player, and everything about a ban source: create, view, edit, delete, sync, and its run history
Events — read server events
Integrations — connect, sync and disconnect Patreon and Discord, and choose which Patreon tiers and Discord guild roles feed each access list
Invitations — create, cancel, and list invitations
Members — read, update, and remove members; create is defined but not wired to any route yet, because members join through an invitation
Notes — create, read, and delete player notes; there is no edit, by design
Organization — organization:update renames the organization and reads its subscription and server limit on the Billing page; organization:delete (Owner only) deletes the organization and changes billing.
Patrons — view patrons, and exclude a patron from access or lift the exclusion
Players — read player profiles and IP addresses, and verify or unverify a player’s game ID
Roles — create, read, update, delete roles
Servers — create, read, update, and retire servers
Support — grant heliana support access to the organization for 24 hours; held by Owners and Admins by default
Tags — read tags, add players to a tag and remove them (tag:assign), and create, edit, or delete tags in the catalog (tag:manage)
Automations — create, read, update, delete automations
Automation actions — one row per manual automation. Checking a box here links the role to that automation rather than granting a key; see below.

There is no “Player flags” or “Flag types” group — player tagging lives entirely under Tags (see Tag & watch players).

The Automation actions group is only shown when at least one manual automation exists. These rows are not permission keys: the right to run one named automation is a link between a role and that automation, a second axis alongside the matrix. See Grant per-automation execution rights.

Assign a role to a member

Roles are set when you invite a member (see Invite admins) or updated inline from the Members table. The invite dialog never offers the Owner role; the Members table does, and only the Owner can assign it, which transfers ownership — anyone else is refused.

Custom roles are assigned the same way as built-in ones: the invite dialog and the inline member role-change offer every custom role of the organization next to Admin. Every organization is seeded with one custom role named Moderator at creation.

Audit log, organization settings and support access

Audit Log in the sidebar lists administrative actions across your organization, newest first; more rows load as you scroll. It needs the Audit log key, and entries about a server are narrowed by your server access.
Settings → General holds the Organization card (game, Organization name, URL slug; editing needs the organization management key), the Membership card where you leave the organization, and a Danger zone for deleting it. See Leave or delete.
The same page carries a Support access card for roles that hold support:grant: Grant support access (24h) lets heliana support view and act in the organization for 24 hours. It cannot be revoked early, and granting again restarts the 24 hours. Paste the line the card shows into the support channel in Discord.