What can each role do in Cognocient?

Every teammate has one of five roles. The role decides what they can change. Everyone on the account sees the same attribution data, and what differs is who can alter budgets, keys, routing, credentials, people and billing.

The matrix

✓ allowed, blank not allowed.

How it is enforced

Access is checked on the server before the request reaches its handler, from one policy table that maps every management endpoint to a permission. That has three consequences:

• The UI is not the security boundary. Calling the API directly gets the same answer as the dashboard would.
• New endpoints are safe by default. Anything unclassified is admin-only for writes. The build fails if a state-changing endpoint is left to that default, so each one is decided deliberately.
• Every denial is recorded in the audit log.

A denied request returns 403:

{
  "error": {
    "code": "forbidden",
    "message": "Your role (viewer) does not have permission to do this.",
    "type": "api_error",
    "required_permission": "manage_providers",
    "your_role": "viewer"
  }
}

If your organization requires single sign-on and a member signs in another way, the response is 403 with "code": "sso_required".

Proxy API keys

A proxy key (sk-cog-...) calling the management API is treated as a low-privilege service principal. It can read analytics and use automation endpoints (ingest, outcomes, freeze, estimates), but it cannot manage the team, billing, SSO, provider credentials, other proxy keys, or the audit log. Proxy keys are embedded in application code and are the secret most likely to leak, so a leaked key cannot be used to take over the account.

Frequently asked questions