Centralized Role-based access control (RBAC)

Learn how BrowserStack’s centralized RBAC ensures users have consistent access to products and projects across your organization.

BrowserStack provides a centralized RBAC framework that enables users to maintain consistent product roles across all products and multiple projects within any Group or Organization.

Types of roles

BrowserStack uses two categories of roles to manage access:

• IAM roles: These roles control ownership and administrative privileges across all BrowserStack products. They determine a user’s ability to grant access to others. The IAM roles are Owner, Admin, and User.

• RBAC roles: These roles define what a user can do within BrowserStack’s global entities (Dashboards, Integrations, Projects) and within individual product environments. RBAC roles are standardized so that permissions such as read, create, update, delete, etc., remain consistent across all products, teams and projects. The common roles include:

  • Admin: Has full permissions to view, create, update, delete, archive, and manage all entities.
  • User: Has moderate permissions tailored to their responsibilities.
  • Viewer: Has read-only access to view resources without making any changes.

Member and guest roles for each product

After assigning IAM and RBAC roles, you can set the user’s access level for each product as a Member (licensed) or a Guest(unlicensed).

• Member role (Licensed): A member is a fully licensed user of a product and has complete operational access aligned with their RBAC role. For example, User, Viewer, Admin.
• Guest role (Unlicensed): A Guest is an unlicensed user with limited, view-only access. Guest access is useful when licenses are limited or when users only need visibility.

Invite users

There are a two ways to invite User Members on BrowserStack:

• Send invitation email
• Share invitation link

View user details

You can view each user’s details, including their IAM role, RBAC role, and product-level permissions, in the User Management section:

1. Go to the User Management section in your BrowserStack account.
2. In the user list, locate the user whose access details you want to view. Click the ︙ (more options) icon next to their name, then select View Details:
3. On the user details page, review the assigned IAM role, RBAC role, and product access for that user. You can see products that support the guest role at the top of the dialog.
4. You can scroll down in the dialog to view products that do not support the guest role.

Viewing user access helps you quickly audit permissions and ensure users have the correct access levels.

Modify access for user

You can modify a user’s access to update their IAM role, RBAC role, or product-level permissions.

To change a user’s product access:

1. Log in to your BrowserStack account.
2. Click the User Profile icon in the top-right corner, then select User Management and click Invitations.
3. Find the user whose invite needs to be resent from the Pending Invitations table.
4. Click the three dot (…) icon in the entry of the user and click Modify access.
5. Modify the required access for the invite and click Save.
6. Alternatively, after you add the user to the organization, you can still change their product access. Go to the User Management section in your BrowserStack account.
7. In the user list, locate the user whose access you want to modify. Click the ︙ (more options) icon next to their name, then select Modify access:
8. In the Modify access dialog, update the IAM role, RBAC role, or product access (Member or Guest) as needed. You can see products that support the guest role at the top of the dialog.
   
9. You can scroll down in the dialog to view products that do not support the guest role.
10. Click Save to apply the changes. The user’s access updates immediately.

You can only change the member or guest role for users who are not assigned the Viewer RBAC role.

Override access at a project level

You can override a user’s default RBAC role within a specific project by assigning a different role for that project. You can also override access of a team at project level. This lets you reassign any role to the user for that project, providing flexibility to tailor permissions as needed.

For example, you can change a user’s role from Admin to Viewer in a specific project to restrict edit or delete permissions.

• The user retains their original Admin access for other products and projects.
• The overridden role applies only to the selected project, ensuring granular control over permissions.
• Use this feature to maintain security and limit access where necessary.

To override access at a project level:

1. Go to the Manage Projects page. Click the three dots icon next to the project, then select Manage Access.
2. In the Add users/teams to project dialog, add the user or team to whom you want to assign a different role.
3. In the confirmation dialog, select the desired project-level role from the dropdown. For example, if Sarah’s RBAC role is User, you can change it to Admin for this specific project. Click Confirm.
4. The updated role appears in the project access list.
5. Alternatively, if the user is already added to the project, select the project. In the Access tab, click the user’s current role and choose a new role from the dropdown to update their permissions.

Override access of a team at project level

A team-level override allows you to assign a different role to a user within a specific team, regardless of their default RBAC role. For example, if a user’s default RBAC role is User, but you add them to a team, you can assign them the Admin role for that team.

To override access of a team at project level:

In the project access panel, select the team and choose the desired role (for example, Admin) from the dropdown.

For more information on project-level access, refer to Project management.

You can manage project access using APIs. For more information, refer to the Project API documentation.

Assign roles using Automated User Provisioning

If you use Automated User Provisioning (AUP) with your identity provider, you can assign IAM roles and RBAC roles to users using the BrowserStack attribute. This allows you to manage role assignments directly from your identity provider (IdP) instead of manually assigning roles in BrowserStack.

Attribute Name: primary_role

Default assignment as User, in case of:

• Unexpected, empty or no value
• Attribute controlled by BrowserStack UI

Expected values when attribute is controlled from your identity provider:

The bstack_role attribute accepts comma-separated values in the following format: IAM_role, RBAC_role

• First value: IAM role (Owner, Admin, or User)
• Second value: RBAC role (Admin, User, or Viewer)

Examples

Attribute Value	Description
Admin,User	Assigns IAM role as Admin and RBAC role as User.
User,Viewer	Assigns IAM role as User and RBAC role as Viewer.
Admin,Admin	Assigns IAM role as Admin and RBAC role as Admin.
No value/Empty	The user is assigned to the organization with default settings.

Assign product access using Automated User Provisioning

If you use Automated User Provisioning (AUP) with your identity provider, you can assign product access to users using the BrowserStack attribute. This allows you to manage product access assignments directly from your identity provider (IdP) instead of manually assigning product access in BrowserStack.

Attribute Name: primary_product

By default, no product access is assigned. This is possible in two scenarios:

• Unexpected, empty or no value specified
• Product attribute is controlled from Account section

Expected values when attribute is controlled from your identity provider:

The primary_product attribute accepts comma-separated values. You can add product access in the format Product_name:Access_level where Access_level is either Member or Guest.

Examples

Attribute Value	Description
Visual-Testing:Member,App-Percy:Guest	Assigns Percy product access as Member, and App Percy product access as Guest.
No value/Empty	The user is assigned to the organization with default settings.

Supported product attribute values

Attribute values	Product Update
Browser-Testing	Live Automate
Visual-Testing	Percy
Automate-Testing	Automate
Live-Testing	Live
Mobile-App-Testing	App Live App Automate
App-Automate-Testing	App Automate
App-Live-Testing	App Live
App-Percy	App-Percy
App-Accessibility-Testing	App Accessibility
Accessibility-Testing	Accessibility Testing
Test-Management	Test Management
Test-Observability	Test Reporting & Analytics
Low-Code-Automation	Low Code Automation
Bug-Capture	Bug Capture
Requestly	Requestly
Testing-Toolkit	Testing Toolkit
Central-Scanner	Central Scanner
Automate-turboscale	Automate TurboScale
Accessibility-Design-Toolkit	Accessibility Design Toolkit

User management APIs

We provide the following User Management APIs to support the latest RBAC changes:

• Get user details (v2)
• Update user access (v2)
• Get team details (v2)