diff --git a/server/src/__tests__/company-user-directory-route.test.ts b/server/src/__tests__/company-user-directory-route.test.ts
index c56ea4e0d49..783e6c63754 100644
--- a/server/src/__tests__/company-user-directory-route.test.ts
+++ b/server/src/__tests__/company-user-directory-route.test.ts
@@ -4,11 +4,13 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { accessRoutes } from "../routes/access.js";
 import { errorHandler } from "../middleware/index.js";
 
+const { hasPermission } = vi.hoisted(() => ({ hasPermission: vi.fn() }));
+
 vi.mock("../services/index.js", () => ({
   accessService: () => ({
     isInstanceAdmin: vi.fn(),
     canUser: vi.fn(),
-    hasPermission: vi.fn(),
+    hasPermission,
   }),
   agentService: () => ({
     getById: vi.fn(),
@@ -26,8 +28,8 @@ vi.mock("../services/index.js", () => ({
 
 function createDbStub() {
   const activeMemberships = [
-    { principalId: "user-2", status: "active" as const },
-    { principalId: "user-1", status: "active" as const },
+    { principalId: "user-2", status: "active" as const, membershipRole: null },
+    { principalId: "user-1", status: "active" as const, membershipRole: "owner" },
   ];
   const users = [
     { id: "user-1", name: "Dotta", email: "dotta@example.com", image: "https://example.com/dotta.png" },
@@ -48,7 +50,7 @@ function createDbStub() {
     "updatedAt" in table;
 
   return {
-    select() {
+    select(fields: Record<string, unknown>) {
       return {
         from(table: unknown) {
           if (isCompanyMembershipsTable(table)) {
@@ -57,7 +59,9 @@ function createDbStub() {
                 return query;
               },
               orderBy() {
-                return Promise.resolve(activeMemberships);
+                return Promise.resolve(activeMemberships.map((member) => Object.fromEntries(
+                  Object.keys(fields).map((key) => [key, member[key as keyof typeof member]]),
+                )));
               },
             };
             return query;
@@ -119,14 +123,43 @@ describe("GET /companies/:companyId/user-directory", () => {
         {
           principalId: "user-2",
           status: "active",
+          membershipRole: null,
           user: { id: "user-2", name: null, email: "alex@example.com", image: null },
         },
         {
           principalId: "user-1",
           status: "active",
+          membershipRole: "owner",
           user: { id: "user-1", name: "Dotta", email: "dotta@example.com", image: "https://example.com/dotta.png" },
         },
       ],
     });
   });
+
+  it("lets a company agent read roles without allowing membership management", async () => {
+    hasPermission.mockImplementation(async (_companyId, _principalType, _principalId, permissionKey) => permissionKey !== "users:manage_permissions");
+    const app = createApp({ type: "agent", agentId: "agent-1", companyId: "company-1", source: "agent_key" });
+    const res = await request(app).get("/api/companies/company-1/user-directory");
+    expect(res.status).toBe(200);
+    expect(res.body.users.map(({ principalId, status, membershipRole }: any) => ({ principalId, status, membershipRole }))).toEqual([
+      { principalId: "user-2", status: "active", membershipRole: null },
+      { principalId: "user-1", status: "active", membershipRole: "owner" },
+    ]);
+    expect((await request(app).get("/api/companies/company-1/members")).status).toBe(403);
+    expect((await request(app).patch("/api/companies/company-1/members/member-1").send({ membershipRole: "owner" })).status).toBe(403);
+    expect(hasPermission.mock.calls).toEqual([
+      ["company-1", "agent", "agent-1", "users:manage_permissions"],
+      ["company-1", "agent", "agent-1", "users:manage_permissions"],
+    ]);
+  });
+
+  it("rejects another company and unauthenticated callers", async () => {
+    for (const actor of [
+      { type: "agent", agentId: "agent-1", companyId: "company-2", source: "agent_key" } as const,
+      { type: "none", source: "none" } as const,
+    ]) {
+      const res = await request(createApp(actor)).get("/api/companies/company-1/user-directory");
+      expect(res.status).toBe(actor.type === "none" ? 401 : 403);
+    }
+  });
 });
diff --git a/server/src/routes/access.ts b/server/src/routes/access.ts
index e1fe2566c3f..3279a1ec780 100644
--- a/server/src/routes/access.ts
+++ b/server/src/routes/access.ts
@@ -1382,6 +1382,7 @@ async function loadCompanyUserDirectory(db: Db, companyId: string) {
     .select({
       principalId: companyMemberships.principalId,
       status: companyMemberships.status,
+      membershipRole: companyMemberships.membershipRole,
     })
     .from(companyMemberships)
     .where(
@@ -1399,6 +1400,7 @@ async function loadCompanyUserDirectory(db: Db, companyId: string) {
   return members.map((member) => ({
     principalId: member.principalId,
     status: "active" as const,
+    membershipRole: member.membershipRole,
     user: userMap.get(member.principalId) ?? null,
   }));
 }
diff --git a/ui/src/api/access.ts b/ui/src/api/access.ts
index 35c76898e0f..c77b212d3e1 100644
--- a/ui/src/api/access.ts
+++ b/ui/src/api/access.ts
@@ -149,6 +149,7 @@ export type CompanyMembersResponse = {
 export type CompanyUserDirectoryEntry = {
   principalId: string;
   status: "active";
+  membershipRole: string | null;
   user: { id: string; email: string | null; name: string | null; image: string | null } | null;
 };
 
diff --git a/ui/src/lib/company-members.test.ts b/ui/src/lib/company-members.test.ts
index c8b1e630ba6..f2231d491a6 100644
--- a/ui/src/lib/company-members.test.ts
+++ b/ui/src/lib/company-members.test.ts
@@ -130,6 +130,7 @@ describe("company-members helpers", () => {
       {
         principalId: "user-1",
         status: "active",
+        membershipRole: null,
         user: { id: "user-1", name: "Taylor", email: "taylor@example.com", image: null },
       },
     ];