Roles and Permissions

Overview

Roles determine what each person in an organization can see and do. The platform provides three core roles: the Owner has all permissions and manages the organization; the Admin has broad permissions such as inviting members, creating projects and editing settings; and the Member works on the tasks assigned to them. For most teams, these three roles are enough.

As your needs grow, you can create your own custom roles. For example, you can define roles specific to your team such as “Field Supervisor” or “Accounting” and grant each only the permissions it needs. Permissions work on a feature basis: for each role, you decide one by one which modules and actions (view, create, edit, delete) are allowed. A person like this sees only the areas required for their work; the rest stays closed to them.

The core principle of this approach is least privilege: give everyone just enough access to do their job, and no more. System roles such as Owner and Admin cannot be deleted; but you can edit or remove the custom roles you create at any time.

Who uses it

• Organization owner: Can define all roles and permissions. Can appoint admins, create custom roles and controls the most critical permissions.
• Admins: Manage the team’s day-to-day permission structure; define custom roles and assign roles to members.
• Members: Do not manage roles; they work within the areas defined by their assigned role.

Small teams usually work with only the Owner / Admin / Member roles. Growing teams with different areas of responsibility make finer distinctions with custom roles.

Step-by-step process

1. Open the Roles section. Go to Organization Settings → Roles. Existing system roles (Owner, Admin, Member) and any custom roles you created are listed here.
2. Create a new role. Use “Create Role” to give the role a meaningful name (e.g. “Field Supervisor”) and save it.
3. Set the permissions. Mark which modules the role can see and which actions (view, create, edit, delete) it can perform in each module. Grant only the permissions that are needed.
4. Assign the role to members. Give this role to the relevant people from the Users section. From the moment a person joins, they work with the permissions defined by their role.
5. Update over time. As responsibilities change, edit the role’s permissions. The change immediately affects all members who hold that role.
6. Remove unused roles. Delete custom roles that are no longer used. System roles (Owner, Admin, Member) cannot be deleted.

Process flow

flowchart TD
    A[Open the Roles section] --> B{Is a built-in<br/>role enough?}
    B -- Yes --> C[Assign Owner / Admin / Member]
    B -- No --> D[Create a new custom role]
    D --> E[Select module and action permissions]
    E --> F[Save the role]
    C --> G[Assign the role to a member]
    F --> G
    G --> H[Member works with the role's permissions]
    H --> I{Did responsibility<br/>change?}
    I -- Yes --> E
    I -- No --> J[Permission structure is maintained]

Frequently asked questions

What is the difference between Owner, Admin and Member? The Owner has all permissions and manages the organization (including deletion and ownership). The Admin has broad permissions such as inviting members, creating projects and editing settings, but the most critical actions remain with the Owner. The Member works on the tasks assigned to them.

What is the difference between a custom role and the built-in roles? The built-in roles (Owner, Admin, Member) exist in every organization and cannot be deleted. Custom roles are ones you define that contain only the permissions you select; you create and edit them freely based on your team’s structure.

Can I give a person more than one role? The permission structure runs through the role. The best approach is to define a single role that fully covers the person’s responsibility and to gather all the required permissions in that role.

What happens when I change a role’s permissions? The change immediately affects all members who hold that role. If you remove a permission, those people can no longer see that area; if you add one, access opens right away.

If I delete a custom role, what happens to the people in it? Before deleting the role, it is recommended to give the people assigned to it a new role. That way no one is left without permissions and their access continues uninterrupted.

Why should I limit access instead of giving everyone broad permissions? Least privilege is the foundation of security. Giving everyone only what they need for their work reduces the risk of accidental changes and data leaks, and also clarifies responsibility.