fix

apps/web/src/lib/company-admin.test.ts

@@ -14,6 +14,7 @@ type MeFixture = {
 	membership?: { role: string; status?: string } | null;
 	staff_access?: MeResponse["staff_access"];
 	impersonating?: boolean;
+	is_owner?: boolean;
 };
 
 function me(partial: MeFixture = {}): MeResponse {
@@ -34,7 +35,8 @@ function me(partial: MeFixture = {}): MeResponse {
 		user,
 		membership,
 		staff_access: partial.staff_access,
-		impersonating: partial.impersonating
+		impersonating: partial.impersonating,
+		is_owner: partial.is_owner
 	};
 }
 
@@ -77,6 +79,13 @@ describe("canManageCompany", () => {
 		);
 	});
 
+	it("allows company owner without company admin role", () => {
+		assert.equal(
+			canManageCompany(me({ membership: { role: "member" }, is_owner: true })),
+			true
+		);
+	});
+
 	it("allows impersonating sessions", () => {
 		assert.equal(
 			canManageCompany(me({ membership: { role: "member" }, impersonating: true })),

apps/web/src/lib/company-admin.ts

@@ -21,12 +21,13 @@ export function isCompanyAdmin(
 
 /**
  * True when the session may perform company-admin mutations (API keys, team, company settings).
- * Includes membership admin, platform/full admin, and non-prod privileged impersonation
+ * Includes membership admin, company owner, platform/full admin, and non-prod privileged impersonation
  * (demo/platform actor switched into a member tenant — matches API allowCompanyAdminOrPlatform).
  */
 export function canManageCompany(me: MeResponse | null | undefined): boolean {
 	if (me == null) return false;
 	if (isCompanyAdmin(me)) return true;
+	if (me.is_owner) return true;
 	if (isFullPlatformAdmin(me)) {
 		return true;
 	}