Roles and extra permissions

Compose access from a system role, optional custom roles, and optional extra permissions. People who keep their current role are unchanged. Admin always has every permission.

​

System roles

Member, Editor, and Admin come with the workspace and cannot be deleted.

• Member: default access for daily work
• Editor: create and share most products, without workspace settings
• Admin: every permission, including workspace settings and user management

Open the workspace menu, select Workspace settings, then under User management open Roles. Open a role to see permissions grouped by area, and turn on only what that role should include. Editing a role updates everyone who has it. Admin always has every permission and cannot be reduced. The permission catalog is on Permission Recommendations.

​

Create a custom role

Use a custom role when several people need the same extra access. You can create up to 5 custom roles. A few AI champions should create agents and share templates without becoming admins. Create a Champion role, then assign it on Members. If usage gets too high, turn that permission off on the role. Everyone with Champion loses it at once.

​

Give someone a role or an extra permission

On Members, click the person’s role. The Edit access drawer opens. Keep one of Member, Editor, or Admin. You can add as many custom roles as you like. Extra permissions are one-off access on top of their roles. Rows that already come from a role show Granted by that role, Also in that role, or Direct. If extras get large, you’ll see Use a role instead. Promoting someone to Admin clears custom roles and extras. Admin already includes every permission. Click Save when you are done.

​

Group permissions

Workspace roles and extras apply to a person across the workspace. Groups have their own roles. Those are not the same as Member, Editor, or Admin on Members. Open Groups.

​

Group roles

Group roles only apply inside that group. They do not open workspace settings.

• Member can use things shared with the group
• Editor can share things with the group
• Admin can do that, plus change group roles and promote people in the group

A group Admin is not a workspace admin.

​

Group leader

A group leader is a group Admin with Grant extra permissions to group members. They can then grant Product permissions to people in that group, such as Create agents or Share templates. They can grant only to people in that group. Those product permissions then apply across the workspace, not only in the group. They cannot open workspace Members or Roles, cannot create custom roles, and cannot assign the workspace Editor or Admin role. They cannot turn a product on or off for the workspace. They can still change group roles. If a product is already on, they can grant it to people in their group, including expensive ones such as Workflows. Give this only to people you trust with that control. If you want several people to have the same extras, and you want to take those extras away in one place, use a custom role instead. A group leader can grant the same access again. You can also grant View governance on a group. That opens Governance only for resources owned by people in the group. Sharing the group is not enough. Rows the person already has show Already from their workspace role.

​

Give a group leader product access

A company of a few hundred people has an AI enablement group. Anna stays workspace admin. Max is in that group. He should grant Create agents to people in the group, without billing or workspace settings.