Docs / Troubleshooting / Team Access Denied Playbook

Team Access Denied Playbook

Published · Last updated: May 2026 · 3 min read

Who this is for

Org owners and admins helping a team member who cannot access certain features, or a team member who is unexpectedly getting "Access Denied" or "Forbidden" errors.

Role Summary

CloudAIPilot has three roles within an organization:

RoleCan do
OwnerAll actions, including billing, delete org, add/remove members, all admin actions
AdminAll operational actions: provision servers, create sites/apps, manage backups, modify cloud accounts
MemberRead-only: view servers, view sites, view apps, view backups, view monitoring

If a team member cannot perform an action, it is likely because they have a member role when they need admin.

Step 1 — Identify the Access Error

Common FORBIDDEN error situations:

ActionMinimum role required
View servers/sites/appsMember
Create a backupMember
Restore a backupAdmin
Delete a backupAdmin
Provision a serverAdmin
Create/edit a site or appAdmin
Manage backup schedulesAdmin
Add/remove cloud accountsAdmin
Add/remove team membersOwner
Delete the organizationOwner

Step 2 — Check the Team Member's Role

  1. Go to Settings → Team.
  2. Find the team member.
  3. Check their current role (Member / Admin / Owner).

Step 3 — Update the Role (Owner Required)

Only the Owner can change roles.

  1. Go to Settings → Team.
  2. Click the Edit icon next to the team member.
  3. Change their role to Admin if they need operational access.
  4. Click Save.

Step 4 — Re-test Access

Ask the team member to:

  1. Log out of CloudAIPilot.
  2. Log back in.
  3. Retry the action.

Role changes take effect immediately but the frontend may cache the old role until the session is refreshed.

Common Access Issues

SymptomLikely causeFix
"Not authorized" on backup restoreUser is a Member, not AdminPromote to Admin
Cannot see the FinOps sectionFinOps may be a higher-role or premium featureCheck feature availability for the org's plan
Team member cannot see org at allThey were removed from the orgRe-invite them via Settings → Team
Org shows but all data is blankSession token expired or org switch not appliedLog out and log back in
Member can see servers but not createMember role is correct behavior — read-onlyPromote to Admin if creation is needed

Related Articles