Create A Role
Add a custom role and choose the permissions it should include.
Roles group permissions so you can give teammates the right level of access without managing every permission one by one.
Create roles around responsibilities, not around individual people. This keeps permissions easier to review as the team changes.
Plan the Role
Before creating the role, write down what the person should be able to do in normal work. Separate everyday access from sensitive access such as billing, finance exports, HRM records, API keys, workflow administration, and workspace settings.
Use roles for repeatable responsibilities. Use direct permissions only for a short-term exception or a very specific member.
Create A Role
- Open Settings.
- Go to Access Control.
- Open the Roles tab.
- Select Create role.
- Enter a role name.
- Create the role.
After creating the role, review its permissions before assigning it to members.
Create the role first, then add permissions deliberately. A new role with a clear name but unreviewed permissions can give users either too little access or more access than the responsibility requires.
Add Or Remove Role Permissions
In the access-control permissions area, turn permissions on or off for the role. System roles can be restricted from editing, especially owner-level roles.
Work module by module. Start with the fewest permissions required, then add access only when a real workflow needs it. For example, a support role may need contacts and tickets, but not estimates, payroll, or API settings.
When a permission controls destructive work, such as delete, archive, export, or settings changes, give it only to people who are expected to own that outcome.
Treat finance exports, HRM/payroll, API keys, workflow publishing, integrations, and workspace settings as high-risk permissions. Add them only when the role needs them for normal work.
Naming Roles
Use role names that describe responsibility, such as Sales, Finance Reviewer, Project Manager, or Support Agent.
Avoid naming roles after people. A role called Sarah becomes confusing when
another person needs the same access.
Before Assigning
Review the role with one test member or a low-risk account. Confirm the member can access the pages they need and cannot access sensitive areas such as billing, finance, HRM, API keys, or admin settings unless intended.
Assign the Role
After the role is ready:
- Open the member in Settings > Members or Access Control.
- Choose the new role.
- Save the member.
- Ask the member to refresh the app or sign in again if permissions do not update immediately.
Review direct permissions on the same member. Direct permissions can make a member more powerful than their role suggests.
Maintain Roles
When multiple people need the same direct permission, update the role instead. When a role grows too broad, split it into clearer responsibilities.
Schedule a permissions review after team changes, finance process changes, or new module rollouts. Remove unused permissions before they become normal.
Keep a short internal note for sensitive roles that explains why they exist and who should approve membership. This helps future admins avoid copying broad access without context.
Troubleshooting
If a member cannot see a page, confirm the module is enabled for the workspace, then confirm the role has access to that module.
If a member can do more than expected, check for direct permissions, another assigned role, owner/admin status, or stale browser state after a role change.