# Roles & scopes

> Give each integration the access it needs. Roles, scopes, and task assignments are checked together.

Source: https://math-api.qmindlabs.ai/docs/permissions

## Roles

| Role | Permitted work |
| --- | --- |
| Reviewer | Assigned tasks, review actions, notes, attachments, permitted reports, and assignment-scoped monitoring. |
| Owner | All Math tasks and imported runs; assignment, clients, archive, restore, and reopen. |
| Admin | Owner capabilities plus member/audit listings and key management for other enabled Math members. |

The effective role is the lower of the key’s role and the member’s current local Math role. Keys cannot switch identities or grant access to another dashboard.

## Scopes

| Scope | Purpose |
| --- | --- |
| `read` | Read metadata, tasks, workflow, and monitoring. |
| `write` | Change workflow, add notes, and manage clients within your role. |
| `files:read` | Read attachments, evidence, and permitted file bytes. |
| `files:write` | Upload or remove permitted attachments. |
| `paths:read` | Read private source and imported storage identifiers. |
| `keys:manage` | Issue, inspect, or revoke permitted keys. |

Each endpoint lists its required scopes and roles. Bug submissions require both `write` and `files:write`.

## Task and report boundaries

Reviewer lists, counts, searches, and downloads are limited to current assignments. A report shared by several tasks is accessible to a reviewer only when every linked task is assigned to them. Whole-run research is restricted to owners and administrators.

## Common key configurations

| Integration | Scopes |
| --- | --- |
| Read-only monitoring | `read` |
| Report retrieval | `read`, `files:read`; add `paths:read` for storage paths. |
| Review automation | `read`, `write`; add file scopes for attachments. |

**Scopes only narrow access**

A scope never upgrades a role or bypasses a task assignment. A child key cannot exceed its issuer or target member.