# TiDB Cloud Administrator Authorization - Organization Level

+ At the organization level, TiDB Cloud defines 4 roles

| Permission                                                                                  | `Owner` | `Billing Admin` | `Console Audit Admin` | `Member` |
| :------------------------------------------------------------------------------------------ | :------ | :-------------- | :-------------------- | :------- |
| Manage organization settings, such as projects, API keys, and time zones.                   | Yes     | No              | No                    | No       |
| Invite users to or remove users from an organization, and edit organization roles of users. | Yes     | No              | No                    | No       |
| All the permissions of Project Owner for all projects in the organization.                  | Yes     | No              | No                    | No       |
| Create projects with Customer-Managed Encryption Key (CMEK) enabled                         | Yes     | No              | No                    | No       |
| View bills and edit payment information for the organization.                               | Yes     | Yes             | No                    | No       |
| Manage TiDB Cloud console audit logging for the organization.                               | Yes     | No              | Yes                   | No       |
| View users in the organization and projects in which the member belong to.                  | Yes     | Yes             | Yes                   | Yes      |

------------------------------------------------------------------------------------------------------------------------------------------------------
The `Organization Console Audit Admin` role is only visible upon request.