Skip to navigation
Product Guides

Team & Permissions

Every teammate you invite gets exactly one permission profile, which governs what they can do across every module your organization has enabled. Manage this from Settings → Team.

Built-in profiles

ProfileWhat it can do
OwnerEverything, including billing and transferring ownership. Exactly one per organization.
AdminManage users, profiles, and settings; full data access. Can’t transfer ownership or manage the organization’s own billing.
ManagerFull operate + approve rights within their part of the org hierarchy — approving expenses, managing their team’s records.
MemberWorks their own records, plus whatever’s explicitly shared with them.
ViewerRead-only across every enabled module — no creates, edits, or deletes anywhere.
Billing UserFull access to Billing; read-only everywhere else.
Expense ApproverCan submit and approve expenses; read-only everywhere else.

Profiles are immutable system defaults — you assign one per person rather than building custom permission sets from scratch.

Inviting a teammate

Add them by email under Settings → Team → Invite, and assign a profile at the same time. You can change a teammate’s profile later from the same screen.

Under the hood: permission keys

Every check ultimately resolves to a module:resource:action key — e.g. crm:lead:create, billing:invoice:export. You’ll see these in error responses when a request is blocked ("required": "crm:lead:view"), which is the fastest way to tell a teammate exactly what to ask for.

The core module covers everything that isn’t tied to one product — members, roles, workspace settings, branding, audit logs, import/export jobs, SSO, and items (core:item:view, core:item:create, core:item:delete).

Members can view core resources but not create or edit them — writes to workspace-level configuration are reserved for Manager and above. That is why the Member profile can view items without being able to add them.

  • Core Concepts — how module entitlement and permission checks combine on every request
  • Plans & Modules — which modules exist for a profile to have access to in the first place