Access control reference

This reference describes the current access model used by the console. Access is evaluated from organization role, plan entitlements, and organization feature flags.

Organization roles

Role	Internal value	Behavior
Admin	org:admin	Can manage organization settings and admin-gated actions such as adding monitored domains, editing settings, and creating or changing organization-level configuration.
Member	org:member	Can use product surfaces available to the organization, but cannot manage admin-only settings.

Settings pages are admin-only. If a member opens Settings, the console shows an admin-required state.

Plan entitlements

Plan entitlements are cumulative unless a feature flag explicitly overrides access.

Plan	Entitlements added at this plan
Basic	No app entitlements in the current entitlement map.
Plus	Discover tool, lookup geolocation details, lookup classification details, lookup RDAP details, lookup screenshots, interactive browser.
Pro	Overview, monitored domains, rules, alerts, Explore, notification settings, plus all Plus entitlements.
Business	Audit logging, messaging integrations, reports, plus all Pro and Plus entitlements.
Enterprise	Same plan-entitlement set as Business in the current code path, with additional access usually controlled by organization feature flags or commercial configuration.

Feature-flag entitlements

Some features are controlled only by organization private metadata flags.

Feature	Entitlement	Flag
Domain takedowns	Takedowns	DomainTakedowns
Email Intelligence	IntegrationEmailIntelligence	IntegrationEmailIntelligence

When a flag is set to true, it grants the feature even if the plan does not include it. When a flag is set to false, it blocks the feature even if the plan would otherwise include it.

Console surfaces

Surface	Access source
Overview	Pro plan or higher.
Domains	Pro plan or higher. Adding domains also requires Admin.
Rules	Pro plan or higher.
Alerts	Pro plan or higher.
Explore	Pro plan or higher.
Reports	Business plan or Enterprise plan.
Slack and webhooks	Business plan or Enterprise plan through messaging integrations.
API keys	Settings access, which requires Admin. Endpoint scopes still apply to each key.
Notifications	Pro plan or higher, plus Admin because the tab is under Settings.
Activity log	Business plan or Enterprise plan, plus Admin because the tab is under Settings.
Takedowns	DomainTakedowns feature flag.
Email Intelligence	IntegrationEmailIntelligence feature flag.

Note

This page documents application access logic, not billing contracts. If a contract grants access outside the standard plan table, the organization should have matching feature flags or metadata in the application.