Sandbox guide

CapabilitiesTeams and accounts

Roles and permissions

Give people different powers, such as read-only or admin.

9 yes5 with a catch0 no2 not published

Who offers it

Part of Teams and accounts, which explains why it matters.

Fully: Agent 37, Blaxel, Boat, boxd, Cloudflare Sandbox, InstaBox, Runtime, Sprites and Vercel Sandbox. With a catch: Daytona, Lizard, Modal, Sandboxer and Tensorlake.

  • Agent 37Yes

    Admins control instances, keys, billing and the team; users get the rest.

    docs-confirmed “`admin` | Everything: instances, keys, billing, and the team.” Source

  • BlaxelYes

    Three workspace roles, plus scoped service-account tokens.

    docs-confirmed “There are three roles that a user or service account can have in a workspace: **admin**, **member** and **viewer**.” Source

  • BoatYes

    Owners and admins manage the organisation; members run sandboxes.

    docs-confirmed “Every member uses them, unless an owner or admin” Source

  • boxdYes

    Three org roles, and a key can be a member key or a userless org key.

    docs-confirmed “An org has three roles: **owner**, **admin**, and **member**.” Source

  • Cloudflare SandboxYes

    Cloudflare account roles decide who can deploy and read the Worker; there is no sandbox-level role.

    docs-confirmed “Members and permissions” Source

  • InstaBoxYes

    Organisation roles are admin and member; keys carry read, write and delete scopes.

    docs-confirmed “Between `admin` and `member`.” Source

  • RuntimeYes4 roles

    Owner, admin, developer and billing member, with compartments for keys.

    docs-confirmed “Each is an owner, admin, developer or billing member.” Source

  • SpritesYes

    Roles come from the Fly.io organisation that owns the Sprite.

    docs-confirmed “Sprites uses your Fly.io account for authentication” Source

  • Vercel SandboxYes

    Team roles include a free read-only Viewer seat.

    pricing-page “Unlimited free Viewer seats with read-only access” Source

  • DaytonaWith a catch

    The catch: Roles decide who can manage the organisation, but any member or key can still run commands in any running sandbox.

    docs-confirmed “Every member of an organization can address that organization's running sandboxes” Source

  • LizardWith a catch

    The catch: Role-based access is listed only on the Enterprise plan; the Pro plan marks it not included.

    pricing-page “RBAC & audit log” Source

  • SandboxerWith a catch

    The catch: Only two roles exist; there is no read-only role or finer permission.

    docs-confirmed “To remove members, change roles or set caps, use the dashboard's **Organization** page.” Source

  • TensorlakeWith a catchAdmin and member only

    The catch: Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan.

    docs-confirmed “Organizations implement a role-based access control system with two distinct roles: admin and member.” Source

  • E2BNot published

    The workspace page covers who has access but does not describe named roles or their powers.

    docs-confirmed “who has access to them” Source

  • MorphNot published

    No role list or permission table is published; sharing is per devbox.

    docs-confirmed “devboxes are shareable live via URL to anyone in your Morph Cloud organization” Source

Related

Other capabilities in this feature

Where it decides the choice

The feature

Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.