CapabilitiesTeams and accounts
Roles and permissions
Give people different powers, such as read-only or admin.
Short answer: 9 of 16 providers offer it fully: Agent 37, Blaxel, Boat, Cloudflare Sandbox, InstaBox, Runtime, Sprites, Vercel Sandbox and boxd. With a catch: Daytona, Lizard, Modal, Sandboxer and Tensorlake. Checked 29 October 2026.
Who offers it
Part of Teams and accounts, which explains why it matters.
Fully: Agent 37, Blaxel, Boat, boxd, Cloudflare Sandbox, InstaBox, Runtime, Sprites and Vercel Sandbox. With a catch: Daytona, Lizard, Modal, Sandboxer and Tensorlake.
- Agent 37Yes
Admins control instances, keys, billing and the team; users get the rest.
docs-confirmed “`admin` | Everything: instances, keys, billing, and the team.” Source
- BlaxelYes
Three workspace roles, plus scoped service-account tokens.
docs-confirmed “There are three roles that a user or service account can have in a workspace: **admin**, **member** and **viewer**.” Source
- BoatYes
Owners and admins manage the organisation; members run sandboxes.
docs-confirmed “Every member uses them, unless an owner or admin” Source
- boxdYes
Three org roles, and a key can be a member key or a userless org key.
docs-confirmed “An org has three roles: **owner**, **admin**, and **member**.” Source
Cloudflare account roles decide who can deploy and read the Worker; there is no sandbox-level role.
docs-confirmed “Members and permissions” Source
- InstaBoxYes
Organisation roles are admin and member; keys carry read, write and delete scopes.
docs-confirmed “Between `admin` and `member`.” Source
Owner, admin, developer and billing member, with compartments for keys.
docs-confirmed “Each is an owner, admin, developer or billing member.” Source
- SpritesYes
Roles come from the Fly.io organisation that owns the Sprite.
docs-confirmed “Sprites uses your Fly.io account for authentication” Source
Team roles include a free read-only Viewer seat.
pricing-page “Unlimited free Viewer seats with read-only access” Source
- DaytonaWith a catch
The catch: Roles decide who can manage the organisation, but any member or key can still run commands in any running sandbox.
docs-confirmed “Every member of an organization can address that organization's running sandboxes” Source
- LizardWith a catch
The catch: Role-based access is listed only on the Enterprise plan; the Pro plan marks it not included.
pricing-page “RBAC & audit log” Source
The catch: Role-based access starts on the Team plan; the free-to-start Starter plan has no roles.
Three workspace roles, plus environment-level roles, on Team and Enterprise.
docs-confirmed “RBAC is available on the Team and Enterprise plans” Source
- SandboxerWith a catch
The catch: Only two roles exist; there is no read-only role or finer permission.
docs-confirmed “To remove members, change roles or set caps, use the dashboard's **Organization** page.” Source
The catch: Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan.
docs-confirmed “Organizations implement a role-based access control system with two distinct roles: admin and member.” Source
- E2BNot published
The workspace page covers who has access but does not describe named roles or their powers.
docs-confirmed “who has access to them” Source
- MorphNot published
No role list or permission table is published; sharing is per devbox.
docs-confirmed “devboxes are shareable live via URL to anyone in your Morph Cloud organization” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.