Workspace and security

Roles and permissions

Understand ScrumPulse roles, default permissions, delegated access, and administrator-only controls.

Last updated August 8, 2026

ScrumPulse combines Clerk organization membership with server-enforced application roles. Clerk remains the identity source and owns the built-in organization administrator role. ScrumPulse stores operational role assignments and additional delegated permissions in its database.

Every protected API request resolves the current role and required permission before the handler runs. Hiding a navigation item is only a usability aid; the API is the authorization boundary.

Confirmed roles#

Role	Default access
Admin	Full access, including billing and role management. This role comes only from Clerk’s organization administrator claim.
Manager	Read data; manage approvals, runs, schedules, backlog proposals, work items, meetings, organization settings, and feature flags.
Scrum Master	Read data; manage approvals, runs, schedules, and meetings.
Product Manager	Read data; manage backlog proposals, work items, and meetings.
Ordinary Member	Read-only access.

Default permissions matrix#

Capability	Admin	Manager	Scrum Master	Product Manager	Ordinary Member
View organization data	Yes	Yes	Yes	Yes	Yes
Trigger or execute runs	Yes	Yes	Yes	No	No
Approve or reject actions	Yes	Yes	Yes	No	No
Change schedule preferences	Yes	Yes	Yes	No	No
Import or create work items	Yes	Yes	No	Yes	No
Decide backlog proposals	Yes	Yes	No	Yes	No
Ingest meetings	Yes	Yes	Yes	Yes	No
Change organization settings or feature flags	Yes	Yes	No	No	No
Read or replace integration credentials	Yes	No	No	No	No
Open billing checkout or portal	Yes	No	No	No	No
Manage roles and delegated permissions	Yes	No	No	No	No

An administrator can grant additional operational permissions to a non-admin member from Settings → Access & Roles. Delegable permissions include approvals, runs, schedules, backlog, work items, meetings, organization settings, integrations, and feature flags. Billing and role management are never delegable.

Assign an operational role#

You must be a Clerk organization administrator, and the API must have CLERK_SECRET_KEY configured.

Expand Settings in the sidebar.
Select Access & Roles.
Find the organization member.
Select Manager, Scrum Master, Product Manager, or Ordinary Member.
Select any narrowly required Additional delegated permissions.
Select Save.

Expected result: the API stores the assignment and reloads the member’s effective permissions. The change applies to subsequent API requests.

Administrator boundaries#

Assign or remove the organization administrator role through Clerk, not ScrumPulse.
ScrumPulse cannot downgrade or override a Clerk organization administrator.
A database assignment cannot manufacture admin, billing-management, or role-management access.
If Clerk member lookup fails, the role-management screen fails closed instead of showing incomplete membership data.
A user without an active Clerk organization receives read-only access in an isolated user-scoped tenant and cannot administer roles.
A future write endpoint that has no explicit permission mapping defaults to administrator-only access.

Use the smallest role and delegated permission set that supports the person’s work. Review organization membership and assignments regularly.