Access control reference

This reference describes the current access model used by the console. Access is evaluated from organization role, plan entitlements, and organization feature flags.

Organization roles

Role	Internal value	Behavior
Admin	org:admin	Can manage organization settings and admin-gated actions such as adding monitored domains, editing settings, and creating or changing organization-level configuration.
Member	org:member	Can use product surfaces available to the organization, but cannot manage admin-only settings.

Organization settings and configuration changes are admin-only. Domain settings can expose read-only configuration to members, but their change controls remain unavailable.

Plan entitlements

Plan entitlements are cumulative unless a feature flag explicitly overrides access.

Plan	Entitlements added at this plan
Basic	No app entitlements in the current entitlement map.
Plus	Discover tool, lookup geolocation details, lookup classification details, lookup RDAP details, interactive browser.
Pro	Overview, monitored domains, rules, alerts, Explore, notification settings, plus all Plus entitlements.
Business	Audit logging, messaging integrations, reports, plus all Pro and Plus entitlements.
Enterprise	Same plan-entitlement set as Business in the current code path, with additional access usually controlled by organization feature flags or commercial configuration.

Feature-flag entitlements

Some features are controlled only by organization private metadata flags.

Feature	Entitlement	Flag
Domain takedowns	Takedowns	DomainTakedowns
Site Canaries	Canaries	Canaries
Email Intelligence	IntegrationEmailIntelligence	IntegrationEmailIntelligence

When a flag is set to true, it grants the feature even if the plan does not include it. When a flag is set to false, it blocks the feature even if the plan would otherwise include it.

Console surfaces

Surface	Access source
Overview	Pro plan or higher.
Domains	Pro plan or higher. Adding domains also requires Admin.
Rules	Pro plan or higher.
Alerts	Pro plan or higher.
Explore	Pro plan or higher.
Reports	Business plan or Enterprise plan.
Slack and webhooks	Business plan or Enterprise plan through messaging integrations.
API keys	Settings access, which requires Admin. Endpoint scopes still apply to each key.
Notifications	Pro plan or higher, plus Admin because the tab is under Settings.
Activity log	Business plan or Enterprise plan, plus Admin because the tab is under Settings.
Takedowns	DomainTakedowns feature flag.
Site Canaries	Canaries feature flag. Admin is required to create, change, or archive deployments.
Email Intelligence	IntegrationEmailIntelligence feature flag.

Note

This page documents application access logic, not billing contracts. If a contract grants access outside the standard plan table, the organization should have matching feature flags or metadata in the application.