Roles & Permissions

Control who can do what in your organization with role-based access control (RBAC). Assign roles to members and customize permissions.

Understanding Roles

Roles define what actions members can perform:

• Each member has exactly one organization role
• Roles contain a set of permissions
• Higher roles include lower role permissions
• Custom roles available on enterprise plans

Default Roles

Role Hierarchy

Role Comparison

Role Details

Owner

The organization owner has:

• Full control over everything
• Can transfer ownership
• Cannot be removed or downgraded
• Only one owner per organization

Admin

Administrators can:

• All Manager capabilities
• Access organization settings
• Manage billing and subscription
• Create/delete teams
• Remove members
• Set organization policies

Manager

Managers can:

• All Member capabilities
• Manage team membership
• Invite new members (as Member or below)
• View team analytics
• Approve content
• Manage team settings

Member

Standard members can:

• Create analyses and proposals
• Edit their own content
• Share with team and external
• Comment and collaborate
• Use all features
• View assigned content

Viewer

Viewers can:

• View shared content
• Add comments (if allowed)
• Download exports (if allowed)
• Cannot create or edit

Permission Categories

Content Permissions

Team Permissions

Organization Permissions

Integration Permissions

Assigning Roles

Initial Assignment

When inviting members:

1. Enter member email
2. Select role from dropdown
3. Role takes effect when they accept

Changing Roles

Role Change Effects

When you change someone's role:

• New permissions apply immediately
• Active sessions updated
• Member notified of change
• Activity logged

Custom Roles (Enterprise)

Creating Custom Roles

Enterprise customers can create custom roles:

1. Go to Settings > Organization > Roles
2. Click Create Custom Role
3. Name the role
4. Select permissions
5. Set role level
6. Save

Custom Role Settings

Managing Custom Roles

• Edit: Update permissions anytime
• Archive: Hide but preserve assignments
• Delete: Remove (must reassign members first)

Permission Inheritance

How Inheritance Works

Owner (has all permissions)
  ↓
Admin (inherits Owner - transfer + some restrictions)
  ↓
Manager (inherits Admin - org settings)
  ↓
Member (inherits Manager - team management)
  ↓
Viewer (base permissions only)

Overriding Inheritance

Custom roles can:

• Add specific permissions
• Remove inherited permissions
• Mix and match as needed

Team Roles

Separate from Organization Roles

Team roles are independent:

Role Interaction

• Organization role sets baseline
• Team role can grant additional team access
• Cannot exceed organization role limits

Best Practices

Principle of Least Privilege

Give members only the access they need:

• Start with Member role
• Upgrade as responsibilities grow
• Regular access reviews

Role Documentation

Document your role structure:

• Who should have each role
• When to upgrade/downgrade
• Custom role purposes

Regular Audits

Review roles periodically:

• Quarterly permission audits
• Check for over-privileged accounts
• Document changes

Troubleshooting

Member Can't Access Feature

1. Check their role
2. Verify feature permission
3. Check team permissions
4. Look for custom overrides

Role Change Not Working

1. Member may need to refresh
2. Check for active sessions
3. Clear browser cache
4. Contact admin

Accidental Role Change

1. Admins can revert changes
2. Check activity log for original role
3. Change role back
4. Document incident

Next Steps

• Members - Manage members
• Teams - Team management
• Security - Security settings