different-ai/openwork · error

Only workspace owners and super-admins can manage roles.

Error message

Only workspace owners and super-admins can manage roles.

What it means

createRole is gated by access.canManageRoles — only workspace owners and super-admins may define custom roles. When the flag is false the provider throws "Only workspace owners and super-admins can manage roles." before ensureRoleCanBeAssigned and the API call. It is the client-side authorization gate for creating custom organization roles.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx:744

    }

    await runMutation("transfer-ownership", async () => {
      ensureActiveOrganizationSelected();
      const { response, payload } = await requestJson(
        `/v1/members/${encodeURIComponent(memberId)}/transfer-ownership`,
        { method: "POST", body: JSON.stringify({}) },
        12000,
      );

      if (!response.ok) {
        throw getRequestError(payload, response, `Failed to transfer ownership (${response.status}).`);
      }
    });
  }

  async function createRole(input: { roleName: string; permission: Record<string, string[]> }) {
    if (!getCurrentAccess().canManageRoles) {
      throw new Error("Only workspace owners and super-admins can manage roles.");
    }
    ensureRoleCanBeAssigned(input.roleName);

    await runMutation("create-role", async () => {
      ensureActiveOrganizationSelected();
      const { response, payload } = await requestJson(
        "/v1/roles",
        {
          method: "POST",
          body: JSON.stringify(input),
        },
        12000,
      );

      if (!response.ok) {
        throw getRequestError(payload, response, `Failed to create role (${response.status}).`);
      }
    });

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Ask an owner or super-admin to create the role.
2. Verify your role — only owner/super-admin satisfy canManageRoles.
3. Refresh org context if you were recently promoted, then retry.
4. Gate the roleForm and roles screen behind access.canManageRoles.

Example fix

// before
<RoleForm onSubmit={createRole} />

// after
{access.canManageRoles ? (
  <RoleForm onSubmit={createRole} />
) : (
  <p>Only workspace owners and super-admins can manage roles.</p>
)}

if (!access.canManageRoles) return; // gate roleForm submission

try {
  await createRole({ roleName, permission });
} catch (e) {
  if (e instanceof Error && e.message.includes("manage roles")) {
    toast(e.message);
  } else throw e;
}

When it happens

Trigger: Calling createRole({ roleName, permission }) (e.g. from roleForm in the roles screen) while the current member's resolved access lacks canManageRoles.

Common situations: A plain admin or member opens the roles screen via direct URL and submits the create-role form; role screens rendered without checking canManageRoles; stale orgContext after the member's role was downgraded.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Only workspace owners and super-admins can change member rol
• Only workspace owners and super-admins can change settings.
• Only the workspace owner can delete this organization.
• Only workspace admins can invite members.
• Only workspace admins can start seat checkout.

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/9e5f2572a3e48a11. Report an issue: GitHub.