Roles are workspace-scoped except Platform Admin role which is assigned to the first signed-up user.
Platform admin isn't a workspace-scoped role.
The first Kotal Pro user who installs Kotal and sign up assigned a special role called Platform Admin. Platform Admin can set custom domain and enable/disable registration.
Kotal Pro user assigned workspace admin role for every workspace she creates.
Admin can create deployments, secrets and endpoints.
Admin can promote, demote and remove users (including other admins) from workspace.
Workspace writer can create deployments, secrets and endpoints.
Writer can invite other users to the workspace.
Workspace user can view deployments, secrets (without revealing content) and endpoints.