feat(organizations): add admin role with owner-equivalent authority

apps/mobile/src/components/organization/member-row.tsx

@@ -22,11 +22,12 @@ type MemberRowProps = {
 
 export const ROLE_LABEL: Record<OrgRole, string> = {
   owner: 'Owner',
+  admin: 'Admin',
   member: 'Member',
   billing_manager: 'Billing manager',
 };
 
-const ROLE_OPTIONS: OrgRole[] = ['owner', 'member', 'billing_manager'];
+const ROLE_OPTIONS: OrgRole[] = ['owner', 'admin', 'member', 'billing_manager'];
 
 export function MemberRow({
   member,

apps/web/src/app/(app)/components/OrganizationSwitcher.tsx

@@ -97,6 +97,8 @@ export function OrganizationSwitcherView({
     switch (role) {
       case 'owner':
         return 'Owner';
+      case 'admin':
+        return 'Admin';
       case 'billing_manager':
         return 'Billing Manager';
       case 'member':

apps/web/src/app/(app)/organizations/[id]/distribute-funds/page.tsx

@@ -1,4 +1,5 @@
 import { OrganizationByPageLayout } from '@/components/organizations/OrganizationByPageLayout';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { DistributeFundsPage } from './DistributeFundsPage';
 
 export default async function OrganizationDistributeFundsPage({
@@ -9,7 +10,7 @@ export default async function OrganizationDistributeFundsPage({
   return (
     <OrganizationByPageLayout
       params={params}
-      roles={['owner', 'billing_manager']}
+      roles={ORGANIZATION_BILLING_ROLES}
       render={({ organization }) => <DistributeFundsPage organizationId={organization.id} />}
     />
   );

apps/web/src/app/(app)/organizations/[id]/integrations/linear/reinstall/route.ts

@@ -1,6 +1,7 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { getUserFromAuth } from '@/lib/user/server';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { ensureOrganizationAccess } from '@/routers/organizations/utils';
 import { requireActiveSubscriptionOrTrial } from '@/lib/organizations/trial-middleware';
 import { PLATFORM } from '@/lib/integrations/core/constants';
@@ -20,7 +21,7 @@ export async function GET(request: NextRequest, context: RouteContext) {
   }
 
   try {
-    await ensureOrganizationAccess({ user }, id, ['owner', 'billing_manager']);
+    await ensureOrganizationAccess({ user }, id, ORGANIZATION_BILLING_ROLES);
     await requireActiveSubscriptionOrTrial(id);
   } catch {
     return NextResponse.redirect(new URL('/integrations?error=unauthorized', request.url));

apps/web/src/app/(app)/organizations/[id]/subscriptions/kilo-pass/page.tsx

@@ -1,6 +1,7 @@
 import { OrganizationByPageLayout } from '@/components/organizations/OrganizationByPageLayout';
 import { OrgKiloPassBillingHistory } from '@/components/subscriptions/org-kilo-pass/OrgKiloPassBillingHistory';
 import { OrgKiloPassDetail } from '@/components/subscriptions/org-kilo-pass/OrgKiloPassDetail';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 
 export default async function OrganizationKiloPassPage({
   params,
@@ -10,7 +11,7 @@ export default async function OrganizationKiloPassPage({
   return (
     <OrganizationByPageLayout
       params={params}
-      roles={['owner', 'billing_manager']}
+      roles={ORGANIZATION_BILLING_ROLES}
       render={({ organization }) => (
         <div className="space-y-6">
           <OrgKiloPassDetail

apps/web/src/app/(app)/organizations/[id]/subscriptions/kilo-pass/setup/page.tsx

@@ -1,5 +1,6 @@
 import { OrganizationByPageLayout } from '@/components/organizations/OrganizationByPageLayout';
 import { OrgKiloPassSetup } from '@/components/subscriptions/org-kilo-pass/OrgKiloPassSetup';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 
 export default async function OrganizationKiloPassSetupPage({
   params,
@@ -9,7 +10,7 @@ export default async function OrganizationKiloPassSetupPage({
   return (
     <OrganizationByPageLayout
       params={params}
-      roles={['owner', 'billing_manager']}
+      roles={ORGANIZATION_BILLING_ROLES}
       render={({ organization }) => (
         <OrgKiloPassSetup organizationId={organization.id} organizationName={organization.name} />
       )}

apps/web/src/app/(app)/organizations/[id]/subscriptions/page.tsx

@@ -1,5 +1,6 @@
 import { OrganizationByPageLayout } from '@/components/organizations/OrganizationByPageLayout';
 import { OrgSubscriptions } from '@/components/subscriptions/OrgSubscriptions';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 
 export default async function OrganizationSubscriptionsPage({
   params,
@@ -9,7 +10,7 @@ export default async function OrganizationSubscriptionsPage({
   return (
     <OrganizationByPageLayout
       params={params}
-      roles={['owner', 'billing_manager']}
+      roles={ORGANIZATION_BILLING_ROLES}
       render={({ organization }) => <OrgSubscriptions organizationId={organization.id} />}
     />
   );

apps/web/src/app/(app)/organizations/[id]/subscriptions/seats/page.tsx

@@ -1,5 +1,6 @@
 import { OrganizationByPageLayout } from '@/components/organizations/OrganizationByPageLayout';
 import { SeatsDetail } from '@/components/subscriptions/seats/SeatsDetail';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 
 export default async function OrganizationSeatsSubscriptionPage({
   params,
@@ -9,7 +10,7 @@ export default async function OrganizationSeatsSubscriptionPage({
   return (
     <OrganizationByPageLayout
       params={params}
-      roles={['owner', 'billing_manager']}
+      roles={ORGANIZATION_BILLING_ROLES}
       render={({ organization }) => <SeatsDetail organizationId={organization.id} />}
     />
   );

apps/web/src/app/(app)/organizations/[id]/welcome/layout.tsx

@@ -1,6 +1,7 @@
 import { getAuthorizedOrgContext } from '@/lib/organizations/organization-auth';
 import { signInUrlWithCallbackPath } from '@/lib/user/server';
 import { OrganizationContextProvider } from '@/components/organizations/OrganizationContext';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { redirect } from 'next/navigation';
 
 export default async function WelcomeLayout({
@@ -12,7 +13,7 @@ export default async function WelcomeLayout({
 }) {
   const { id } = await params;
   const organizationId = decodeURIComponent(id);
-  const result = await getAuthorizedOrgContext(organizationId, ['owner', 'billing_manager']);
+  const result = await getAuthorizedOrgContext(organizationId, ORGANIZATION_BILLING_ROLES);
   if (!result.success) {
     const href =
       result.nextResponse.status === 401 ? await signInUrlWithCallbackPath() : '/profile';

apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.tsx

@@ -209,6 +209,7 @@ export function AddMemberDialog({
               <SelectContent>
                 <SelectItem value="member">Member</SelectItem>
                 <SelectItem value="owner">Owner</SelectItem>
+                <SelectItem value="admin">Admin</SelectItem>
                 <SelectItem value="billing_manager">Billing Manager</SelectItem>
               </SelectContent>
             </Select>

apps/web/src/app/api/auto-routing/mode/route.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, test } from '@jest/globals';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { TRPCError } from '@trpc/server';
 import { NextRequest } from 'next/server';
 import {
@@ -93,7 +94,7 @@ describe('/api/auto-routing/mode', () => {
         user: expect.objectContaining({ id: USER_ID, is_admin: false }),
       }),
       ORGANIZATION_ID,
-      ['owner', 'billing_manager']
+      ORGANIZATION_BILLING_ROLES
     );
     expect(mockedRequireActiveSubscriptionOrTrial).toHaveBeenCalledWith(ORGANIZATION_ID);
     expect(mockedUpdateAutoRoutingMode).toHaveBeenCalledWith({

apps/web/src/app/api/auto-routing/mode/route.ts

@@ -10,6 +10,7 @@ import {
   updateAutoRoutingMode,
 } from '@/lib/ai-gateway/auto-routing-admin-client';
 import { getUserFromAuth } from '@/lib/user/server';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { ensureOrganizationAccess } from '@/routers/organizations/utils';
 import { requireActiveSubscriptionOrTrial } from '@/lib/organizations/trial-middleware';
 
@@ -71,7 +72,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
 }
 
 export async function PUT(request: NextRequest): Promise<NextResponse> {
-  const owner = await resolveOwner(request, ['owner', 'billing_manager']);
+  const owner = await resolveOwner(request, ORGANIZATION_BILLING_ROLES);
   if ('response' in owner) return owner.response;
   if (owner.ownerType === 'org') {
     try {

apps/web/src/app/api/auto-routing/settings/route.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, test } from '@jest/globals';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { TRPCError } from '@trpc/server';
 import type { AutoRoutingSettingsResponse } from '@kilocode/auto-routing-contracts';
 import { NextRequest } from 'next/server';
@@ -262,7 +263,7 @@ describe('/api/auto-routing/settings', () => {
     expect(mockedEnsureOrganizationAccess).toHaveBeenCalledWith(
       expect.anything(),
       ORGANIZATION_ID,
-      ['owner', 'billing_manager']
+      ORGANIZATION_BILLING_ROLES
     );
   });
 

apps/web/src/app/api/auto-routing/settings/route.ts

@@ -22,6 +22,7 @@ import {
   type AutoRoutingSettingsApiResponse,
 } from '@/lib/ai-gateway/auto-routing-pool-validation';
 import { getUserFromAuth } from '@/lib/user/server';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { ensureOrganizationAccess } from '@/routers/organizations/utils';
 import { requireActiveSubscriptionOrTrial } from '@/lib/organizations/trial-middleware';
 
@@ -156,7 +157,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
 }
 
 export async function PUT(request: NextRequest): Promise<NextResponse> {
-  const owner = await resolveOwner(request, ['owner', 'billing_manager']);
+  const owner = await resolveOwner(request, ORGANIZATION_BILLING_ROLES);
   if ('response' in owner) return owner.response;
   if (owner.ownerType === 'org') {
     try {

apps/web/src/app/api/integrations/bitbucket/connect/route.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, test } from '@jest/globals';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { NextRequest } from 'next/server';
 import { getUserFromAuth } from '@/lib/user/server';
 import { verifyOAuthState } from '@/lib/integrations/oauth-state';
@@ -66,7 +67,7 @@ describe('GET /api/integrations/bitbucket/connect', () => {
     expect(mockedEnsureOrganizationAccess).toHaveBeenCalledWith(
       { user: expect.objectContaining({ id: USER_ID }) },
       ORGANIZATION_ID,
-      ['owner', 'billing_manager']
+      ORGANIZATION_BILLING_ROLES
     );
   });
 });

apps/web/src/app/api/integrations/linear/connect/route.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, test } from '@jest/globals';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 import { NextRequest } from 'next/server';
 import { getUserFromAuth } from '@/lib/user/server';
 import { getLinearOAuthUrl } from '@/lib/integrations/linear-service';
@@ -93,7 +94,7 @@ describe('GET /api/integrations/linear/connect', () => {
     expect(mockedEnsureOrganizationAccess).toHaveBeenCalledWith(
       { user: expect.objectContaining({ id: USER_ID }) },
       'org-linear-123',
-      ['owner', 'billing_manager']
+      ORGANIZATION_BILLING_ROLES
     );
     expect(mockedRequireActiveSubscriptionOrTrial).toHaveBeenCalledWith('org-linear-123');
     const state = mockedGetLinearOAuthUrl.mock.calls[0]?.[0];

apps/web/src/app/payments/topup/route.ts

@@ -7,6 +7,7 @@ import { isValidReturnUrl } from '@/lib/payment-return-url';
 import { captureException } from '@sentry/nextjs';
 import { getOrCreateStripeCustomerIdForOrganization } from '@/lib/organizations/organization-billing';
 import { getAuthorizedOrgContext } from '@/lib/organizations/organization-auth';
+import { ORGANIZATION_BILLING_ROLES } from '@kilocode/app-shared/organizations';
 
 /**
  * NOTE: Crypto payment support (Coinbase Commerce) was removed in January 2026.
@@ -66,7 +67,7 @@ export async function POST(request: NextRequest): Promise<NextResponse<unknown>>
 
   let stripeCustomerId: string | null | undefined;
   if (organizationId) {
-    const orgContext = await getAuthorizedOrgContext(organizationId, ['owner', 'billing_manager']);
+    const orgContext = await getAuthorizedOrgContext(organizationId, ORGANIZATION_BILLING_ROLES);
     if (!orgContext.success) {
       return orgContext.nextResponse;
     }

apps/web/src/components/auto-routing/AutoRoutingModeCard.test.ts

@@ -973,9 +973,11 @@ describe('error messages', () => {
 describe('readonly org member controls', () => {
   it('billing-manager edit permission is isolated from page-level canEdit', () => {
     // Mirrors OrganizationProvidersAndModelsPage derivation.
+    const canManageOrganization = (role: string) => role === 'owner' || role === 'admin';
     const derive = (role: string, isKiloAdmin = false) => {
-      const canEdit = isKiloAdmin || role === 'owner';
-      const canEditAutoRouting = isKiloAdmin || role === 'owner' || role === 'billing_manager';
+      const canEdit = isKiloAdmin || canManageOrganization(role);
+      const canEditAutoRouting =
+        isKiloAdmin || canManageOrganization(role) || role === 'billing_manager';
       return { canEdit, canEditAutoRouting };
     };
 
@@ -991,6 +993,10 @@ describe('readonly org member controls', () => {
       canEdit: true,
       canEditAutoRouting: true,
     });
+    expect(derive('admin')).toEqual({
+      canEdit: true,
+      canEditAutoRouting: true,
+    });
     expect(derive('member', true)).toEqual({
       canEdit: true,
       canEditAutoRouting: true,

apps/web/src/components/organizations/BYOKContent.tsx

@@ -7,6 +7,7 @@ import { useRoleTesting } from '@/contexts/RoleTestingContext';
 import { BYOKKeysManager } from './byok/BYOKKeysManager';
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
 import { AlertCircle } from 'lucide-react';
+import { canManageOrganization } from '@kilocode/app-shared/organizations';
 
 export function BYOKContent({
   organizationId,
@@ -21,8 +22,8 @@ export function BYOKContent({
   const currentRole = assumedRole === 'KILO ADMIN' ? 'owner' : assumedRole || role || 'member';
   const isKiloAdmin = assumedRole === 'KILO ADMIN';
 
-  // Check if user has permission to access BYOK (must be org owner)
-  const hasPermission = currentRole === 'owner';
+  // Check if user has permission to access BYOK (must be org owner or admin)
+  const hasPermission = canManageOrganization(currentRole);
 
   return (
     <OrganizationContextProvider value={{ userRole: currentRole, isKiloAdmin }}>

apps/web/src/components/organizations/FreeTrialWarningBanner.tsx

@@ -11,6 +11,7 @@ import type {
   OrganizationWithMembers,
 } from '@/lib/organizations/organization-types';
 import { capitalize, cn } from '@/lib/utils';
+import { canManageOrganization } from '@kilocode/app-shared/organizations';
 
 type FreeTrialWarningBannerProps = {
   organization: OrganizationWithMembers;
@@ -125,11 +126,11 @@ export function FreeTrialWarningBanner({
   const state = getOrgTrialStatusFromDays(daysRemaining);
   const planName = capitalize(organization.plan);
   const styles = getStylesForState(state, planName);
-  const isOwner = userRole === 'owner';
+  const canManage = canManageOrganization(userRole);
   const buttonVariant = getButtonVariantForState(state);
-  const message = getTrialMessage(daysRemaining, isOwner);
+  const message = getTrialMessage(daysRemaining, canManage);
   const pathname = usePathname();
-  const shouldShowUpgradeButton = isOwner && !pathname.endsWith('/subscriptions');
+  const shouldShowUpgradeButton = canManage && !pathname.endsWith('/subscriptions');
 
   return (
     <div

apps/web/src/components/organizations/OrganizationCodeIndexing.tsx

@@ -7,6 +7,7 @@ import { useOrganizationWithMembers } from '@/app/api/organizations/hooks';
 import { CodeIndexingView } from '@/components/code-indexing/CodeIndexingView';
 import { Badge } from '@/components/ui/badge';
 import { ExternalLink } from 'lucide-react';
+import { canManageOrganization } from '@kilocode/app-shared/organizations';
 
 type OrganizationCodebaseIndexingProps = {
   organizationId: string;
@@ -59,7 +60,7 @@ export function OrganizationCodeIndexing({
   }
 
   // Determine if user can delete branches
-  const canDelete = isAdminView || role === 'owner';
+  const canDelete = isAdminView || canManageOrganization(role);
 
   return (
     <div className="flex flex-col gap-y-6">

apps/web/src/components/organizations/OrganizationDashboard.tsx

@@ -13,7 +13,10 @@ import { OrganizationPageHeader } from './OrganizationPageHeader';
 import { OrganizationWelcomeHeader } from './OrganizationWelcomeHeader';
 import { NewOrganizationWelcomeHeader } from './NewOrganizationWelcomeHeader';
 import { OrganizationTopupSuccessHeader } from './OrganizationTopupSuccessHeader';
-import { canManageOrganizationBilling } from '@kilocode/app-shared/organizations';
+import {
+  canManageOrganization,
+  canManageOrganizationBilling,
+} from '@kilocode/app-shared/organizations';
 import type { OrganizationRole } from '@/lib/organizations/organization-types';
 import { useRoleTesting } from '@/contexts/RoleTestingContext';
 import { useOrganizationWithMembers } from '@/app/api/organizations/hooks';
@@ -156,7 +159,7 @@ export function OrganizationDashboard({
                 ) : (
                   <OrganizationProvidersAndModelsConfigurationCard
                     organizationId={organizationId}
-                    readonly={!(currentRole === 'owner' || isKiloAdmin)}
+                    readonly={!(canManageOrganization(currentRole) || isKiloAdmin)}
                   />
                 )}
               </>
@@ -179,7 +182,7 @@ export function OrganizationDashboard({
                 <SSOSignupCard organization={organizationData} role={currentRole} />
               </LockableContainer>
             )}
-            {(currentRole === 'owner' || isKiloAdmin) && (
+            {(canManageOrganization(currentRole) || isKiloAdmin) && (
               <OrganizationEmailPreferencesCard organizationId={organizationId} />
             )}
             <Card>