different-ai/openwork · error

Only workspace owners and super-admins can change settings.

Error message

Only workspace owners and super-admins can change settings.

What it means

ensureCanManageSettings throws 'Only workspace owners and super-admins can change settings.' when getOrgAccessFlags reports canManageSettings false for the current member's role (owner/super-admin required). It gates updateOrganizationSettings so unauthorized role holders cannot mutate org settings.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx:121

  const isSingleOrgMode = runtimeConfigLoaded && runtimeConfig.orgMode === "single_org";

  function ensureActiveOrganizationSelected() {
    if (!activeOrgId) {
      throw new Error("Organization not found.");
    }
  }

  function getCurrentAccess() {
    return getOrgAccessFlags(
      orgContext?.currentMember.role ?? "member",
      orgContext?.currentMember.isOwner ?? false,
      orgContext?.roles,
    );
  }

  function ensureCanManageSettings() {
    if (!getCurrentAccess().canManageSettings) {
      throw new Error("Only workspace owners and super-admins can change settings.");
    }
  }

  function ensureCanDeleteOrganization() {
    if (!getCurrentAccess().canDeleteOrganization) {
      throw new Error("Only the workspace owner can delete this organization.");
    }
  }

  function ensureRoleCanBeAssigned(role: string) {
    if (roleIncludesCanonicalRole(role, "owner")) {
      throw new Error("The owner role cannot be assigned from this action.");
    }
  }

  function ensureTargetIsNotOwner(memberId: string) {
    const target = orgContext?.members.find((member) => member.id === memberId) ?? null;
    if (target?.isOwner) {

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Confirm the signed-in user's role in the target org is owner or super-admin.
2. Switch to the correct organization if acting in the wrong org context.
3. Wait for orgContext/roles to load before evaluating access (avoid the 'member' default).
4. Hide/disable the settings form unless getCurrentAccess().canManageSettings is true.
5. Have an owner perform the settings change if the current role is legitimately insufficient.

Example fix

// before
await updateOrganizationSettings(orgId, settings);
// after
if (getCurrentAccess().canManageSettings) await updateOrganizationSettings(orgId, settings);
else showToast("Only workspace owners and super-admins can change settings.");

if (!getCurrentAccess().canManageSettings) return; // disable the settings form
await updateOrganizationSettings(orgId, settings);

null

try {
  await updateOrganizationSettings(orgId, settings);
} catch (e) {
  if (e instanceof Error && e.message.includes("owners and super-admins")) {
    showToast("You do not have permission to change settings.");
  } else throw e;
}

When it happens

Trigger: updateOrganizationSettings invoked by a member or admin whose computed access flags (from orgContext.currentMember.role, org membership, and roles) lack canManageSettings — e.g. after a role downgrade, in the wrong org context, or before roles finish loading (defaulting to 'member').

Common situations: A former owner demoted to admin still has an open settings tab, super-admin acting in the wrong organization, getCurrentAccess defaulting to 'member' while orgContext.roles is still loading, or a UI that renders the settings form without checking access flags.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only the workspace owner can delete this organization.
• The owner role cannot be assigned from this action.
• The workspace owner cannot be changed or removed from this a
• Only workspace admins can invite members.
• ${allowedEmailDomains.length === 1 ? `This workspace only al

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/fc4e1b8fff33322d. Report an issue: GitHub.