Workspace Roles and Permissions
CTFFactory uses a four-tier role model to control what workspace members can see and do. Roles are assigned per workspace — a user may hold different roles in different workspaces.
Role Overview
| Role | Intended For |
|---|---|
| Owner | The workspace creator or a designated successor with full administrative authority |
| Admin | Team leads and operations managers who manage people and workspace settings |
| Member | Practitioners who generate challenges, run CTFs, and deploy infrastructure |
| Viewer | Stakeholders who need read-only access to results, reports, and dashboards |
Permissions Matrix
The table below details every capability and which roles can perform it. A checkmark ( Y ) indicates the role has permission; a dash ( — ) indicates it does not.
| Capability | Owner | Admin | Member | Viewer |
|---|---|---|---|---|
| Workspace | ||||
| View workspace dashboard | Y | Y | Y | Y |
| Edit workspace name and slug | Y | — | — | — |
| Delete workspace | Y | — | — | — |
| View audit logs | Y | Y | — | — |
| Manage billing and subscription | Y | — | — | — |
| Branding and Domain | ||||
| Upload logo and set brand colors | Y | Y | — | — |
| Add and verify custom domain | Y | Y | — | — |
| Remove custom domain | Y | — | — | — |
| People | ||||
| View member list | Y | Y | Y | — |
| Invite members by email | Y | Y | — | — |
| Change member roles | Y | Y | — | — |
| Remove members | Y | Y | — | — |
| SSO / OIDC | ||||
| Configure OIDC provider | Y | Y | — | — |
| Enable / disable SSO | Y | Y | — | — |
| Challenges | ||||
| Generate challenges (AI) | Y | Y | Y | — |
| Edit generated challenge content | Y | Y | Y | — |
| Delete challenges | Y | Y | Y | — |
| View challenge list | Y | Y | Y | Y |
| CTF Events | ||||
| Create CTF event | Y | Y | Y | — |
| Edit CTF settings | Y | Y | Y | — |
| Deploy CTF | Y | Y | Y | — |
| Stop / tear down CTF | Y | Y | Y | — |
| View CTF details and scoreboard | Y | Y | Y | Y |
| Learning Paths | ||||
| Browse and enroll (personal) | Y | Y | Y | Y |
| Create custom learning path | Y | Y | — | — |
| Edit learning path cards | Y | Y | — | — |
| Publish / unpublish path | Y | Y | — | — |
| Enroll other users in a path | Y | Y | — | — |
| View learner progress | Y | Y | — | — |
| API Keys | ||||
| Create API key (own account) | Y | Y | Y | — |
| View own API keys | Y | Y | Y | — |
| Revoke own API keys | Y | Y | Y | — |
| View all workspace API keys | Y | Y | — | — |
| Revoke any workspace API key | Y | — | — | — |
| Webhooks | ||||
| Register webhook endpoint | Y | Y | — | — |
| Edit webhook configuration | Y | Y | — | — |
| Delete webhook | Y | Y | — | — |
| View webhook delivery log | Y | Y | Y | — |
| Reports and Stats | ||||
| View CTF analytics | Y | Y | Y | Y |
| Export reports | Y | Y | Y | — |
Changing a Member's Role
Roles can be changed by an Owner or Admin from the People page:
- Navigate to Workspace Settings > People.
- Find the member using the search box.
- Click the role badge next to their name to open the role selector.
- Select the new role and confirm.
The change takes effect immediately. The affected member's current session inherits the new permissions without requiring them to log out.
Owner transfer: To transfer ownership, navigate to Workspace Settings > General and use the Transfer Ownership option. The current Owner must confirm via email. There can only be one Owner per workspace.
Viewer Accounts
Viewer accounts are ideal for:
- Executive stakeholders who need access to scoreboards and reports without the ability to modify anything
- External auditors requiring read access to CTF results for compliance purposes
- Client contacts observing a managed CTF event
Viewer accounts do not consume AI credits when accessing the platform.