Managing factory permissions

Give teammates User access to run work without changing the factory, or Editor access to configure its agents, repositories, and automations. The User role appears as Factory user in dropdowns.

Role management requires an Enterprise plan. On other plans, team members have Editor access.

Roles and capabilities

Action	User	Editor	Admin
View the factory and run work	Yes	Yes	Yes
Edit the factory’s name, handle, and definition	No	Yes	Yes
Configure agents, repositories, and automations	No	Yes	Yes
Attach existing secrets, MCP servers, and integrations	No	Yes	Yes
Manage factory roles	No	No	Yes
Create a factory	No	Yes	Yes
Delete the factory	No	No	Yes

Factory creation uses your team-level role. An Editor override for one factory doesn’t grant permission to create factories.

Team and workspace admins and owners inherit Admin access from their team or workspace role. You can’t assign Admin in a factory’s role settings or reduce an admin’s access with a User override.

Editors can attach resources already connected to the team. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions.

How roles apply

A team-level role applies across the team’s factories. Override that role for one factory to give a teammate different access there.

For example, a teammate with User access across the team can have Editor access to the payments factory they maintain.

For Enterprise team members who aren’t admins, Warp uses the first role set in this list:

Priority	Role source
1	The person’s override for this factory
2	The person’s team-level Warp Factories role
3	The applicable workspace or team default
4	Editor, if no role or default is set

Defaults apply to new and existing members without an assigned role. A workspace default takes priority over the team default. Explicit team roles and per-factory overrides stay unchanged.

Changing a team-level role

You must be a team or workspace admin to assign User and Editor roles.

1. In the Warp Factories web app, open a factory and click Settings > Access.
2. Click Manage team access.
3. In the teammate’s row, click their current seat type.
4. Choose Factory user or Editor, then click Save.

The role applies across the team’s factories, except where the teammate has an override.

Changing a role for one factory

Team and workspace admins can change a teammate’s role for one factory:

1. In the web app, open that factory and click Settings > Access.
2. Find the teammate by name or email. In their role dropdown, choose Factory user or Editor.
3. Click Save changes.

The change applies only to this factory. The teammate keeps their existing role in other factories.

Factory permissions and external access

Factory roles don’t grant access to repositories or external services. Runs use the configured repository identity, secrets, and MCP servers.

Specification approval follows the foreman’s instructions. Your repository’s permissions and branch protection control who can approve and merge pull requests. See Human decision points and permissions.

Related pages

• About factory infrastructure and security
• Definitions as code
• Roles and permissions - Manage team roles
• Workspaces for Enterprise teams - Manage workspace roles