Permissions and Roles

Introduction to Permissions and Roles

The platform uses a role-based access control (RBAC) system to manage what users can see and do within your organization. This ensures the right people have access to the right features and data.

Understanding Roles

Built-in Roles

The platform includes four built-in roles with different permission levels:

Owner

The organization owner has full access to everything:

• Complete control over all features and data
• Manage billing and subscription
• Delete the organization
• Transfer ownership to another member
• Cannot be removed from the organization

Each organization has exactly one owner. Ownership can be transferred but not shared.

Admin

Administrators have broad access to manage the organization:

• Access all features and data
• Manage team members and invitations
• Configure organization settings
• Create and manage API keys
• View and manage audit logs
• Delete any content
• Cannot delete the organization or manage billing

Member

Members are the default role for new team members with full content creation capabilities:

• Create experiments, OKRs, documents, workflows, dashboards, and growth models
• Edit any content (not just their own)
• Delete their own content only
• View audit logs (read-only)
• Cannot access administrative settings
• Cannot manage team members or API keys

Members are ideal for team contributors who need to actively work with content.

Viewer

Viewers have read-only access to all features:

• View all experiments, OKRs, workflows, dashboards, documents, and growth models
• View audit logs (read-only)
• Cannot create, edit, or delete any content
• Cannot access administrative features

Viewers are ideal for stakeholders who need visibility into progress without editing capabilities.

Role Hierarchy

Roles follow a hierarchy where higher roles have more permissions:

Owner > Admin > Member > Viewer

Managing Team Members

Inviting Members

To invite new team members:

1. Navigate to Settings > Team
2. Click Invite Member
3. Enter their email address
4. Select their role:
   • Admin - Full access to manage the organization
   • Member - Create and edit content, delete own content
   • Viewer - Read-only access
5. Click Send Invitation

The invitee receives an email with a link to join your organization.

Invitation Status

Invitations have the following statuses:

• Pending - Invitation sent, awaiting response
• Accepted - User has joined the organization
• Expired - Invitation link has expired
• Revoked - Invitation was cancelled

Changing Roles

To change a member's role:

1. Go to Settings > Team
2. Find the member
3. Click on their current role
4. Select the new role
5. Confirm the change

Only owners and admins can change roles. Members can be promoted to Admin. Admins can be demoted to Member.

Removing Members

To remove a member from your organization:

1. Go to Settings > Team
2. Find the member
3. Click Remove
4. Confirm removal

Removed members lose access immediately. Their content (experiments, documents, etc.) is preserved but reassigned or made available to admins.

Transferring Ownership

The organization owner can transfer ownership:

1. Go to Settings > Team
2. Click Transfer Ownership
3. Select the new owner
4. Confirm with your password
5. The new owner receives owner privileges

After transfer, the previous owner becomes an Admin.

Permission Requests

For sensitive operations, the platform supports a permission request workflow.

How Permission Requests Work

When a member needs elevated access:

1. The member initiates a permission request
2. The request goes to an approver (Admin or Owner)
3. The approver reviews and approves/denies
4. If approved, the member gains temporary access

Request Types

Permission requests specify the type of access needed:

• Create - Permission to create new resources
• Read - Permission to view resources
• Update - Permission to modify resources
• Delete - Permission to remove resources

Request Lifecycle

1. Pending - Request submitted, awaiting review
2. Approved - Request granted
3. Denied - Request rejected
4. Expired - Request timed out

Requesting Permissions

To request additional permissions:

1. Attempt the action you need permission for
2. If denied, click Request Access
3. Select the permissions you need
4. Optionally add a message explaining why
5. Submit the request

Approving Requests

Admins and Owners can approve requests:

1. Go to Settings > Permission Requests
2. Review pending requests
3. For each request, choose:
   • Approve - Grant the requested permissions
   • Deny - Reject the request
4. Optionally add notes explaining your decision

Request Expiration

Approved permissions have an expiration:

• Set when the approval is granted
• After expiration, access is automatically revoked
• Users must re-request if they still need access

Feature-Specific Permissions

Different features have specific permission requirements. The tables below show what each role can do.

Experiments

OKRs

Documents

Workflows

Growth Models

Analytics Dashboards

Organization Settings

API Keys

Webhooks

Audit Logs

Audit Logging

All permission-related actions are logged:

• Role changes
• Member additions and removals
• Permission requests and approvals
• Settings changes

View the audit log at Settings > Audit Log to see who did what and when.

Best Practices

Role Assignment

• Start new members as Viewer if they only need to observe
• Use Member (default) for contributors who need to create and edit content
• Promote to Admin only for those who need to manage team and settings
• Limit the number of Admins to reduce security risk
• Document why each Admin needs elevated access

Security

• Review team members regularly
• Remove access for departing employees promptly
• Use permission requests for sensitive operations
• Monitor audit logs for suspicious activity

Onboarding

• Create a clear process for new member onboarding
• Document which roles are needed for which teams
• Use invitations rather than sharing login credentials
• Set up proper handoffs when members leave