Roles and permissions
Everyone has one workspace role, and one role in each project they are in.
Workspace roles
A workspace role covers users, teams, billing and settings. On its own it gives no access to any project's work.
| Role | What it means |
|---|---|
| Admin | Invites and removes people and runs teams, billing accounts, data formats and API keys. Administers every project but sees a project's work only once they are in it. |
| Member | Can create projects. Everything else comes from their project roles. |
| Viewer | Cannot create projects or change any work. Is a Viewer in every project they are in. |
See Change someone's workspace role.
Project roles
Each role holds everything the one before it does.
| Role | Adds |
|---|---|
| Viewer | Reading the project's areas, orders, deliverables and control data |
| Editor | Areas and area groups, draft orders, control data uploads, linking and moving areas and files |
| Approver | Approving, cancelling or asking for an amendment to an order awaiting approval |
| Manager | Members, project settings, moving orders, deleting the project |
How the two combine
A workspace Viewer is always a project Viewer
A workspace Viewer can be added to any project but only as Viewer, whatever a team default or Role on arrival says. Making someone a workspace Viewer sets all their project roles to Viewer, and changing it back does not restore them.
A workspace Admin administers projects without being in them
In every project, whether or not they are in it, a workspace Admin can manage members (themselves included) and teams, edit the project's settings and delete it. They cannot see its areas, orders, deliverables or control data until they add themselves; from then on they also have their project role.
Approving needs an Approver or Manager project role
Being a workspace Admin does not let you approve orders. Only an Approver or Manager in the order's project can approve, cancel or ask for an amendment, and only they get approval notifications.
Permission matrix
Workspace actions depend on the workspace role. Project actions depend on the project role (a workspace Viewer always gets the Viewer column); the Admin column shows an Admin in a project they are not in.
| Action | Admin | Member | Viewer | Project Viewer | Editor | Approver | Manager |
|---|---|---|---|---|---|---|---|
| Workspace | |||||||
| See the Users and Teams pages | Yes | Yes | Yes | - | - | - | - |
| Invite people, resend or rescind invitations | Yes | No | No | - | - | - | - |
| Change workspace roles, remove people | Yes | No | No | - | - | - | - |
| Create, edit and delete teams, add and remove team members | Yes | No | No | - | - | - | - |
| Create a project | Yes | Yes | No | - | - | - | - |
| See billing accounts, data formats and credits | Yes | Yes | Yes | - | - | - | - |
| Create, edit, delete and set the default billing account or data format | Yes | No | No | - | - | - | - |
| Create, edit, roll and revoke API keys | Yes | No | No | - | - | - | - |
| See Tile Usage | Yes | No | No | - | - | - | - |
| Leave the workspace | Yes | Yes | Yes | - | - | - | - |
| Project | |||||||
| See the project's member list and settings | Yes | - | - | Yes | Yes | Yes | Yes |
| See the project's areas, orders, deliverables and control data | No | - | - | Yes | Yes | Yes | Yes |
| Create, edit and delete areas and area groups | No | - | - | No | Yes | Yes | Yes |
| Bring in an area from another project, move areas and groups (needs Editor on both projects) | No | - | - | No | Yes | Yes | Yes |
| Upload, rename, move and delete control data | No | - | - | No | Yes | Yes | Yes |
| Create, edit, submit and delete draft orders | No | - | - | No | Yes | Yes | Yes |
| Open, approve, cancel or ask for an amendment to an order awaiting approval | No | - | - | No | No | Yes | Yes |
| Move an order (needs Manager on both projects) | No | - | - | No | No | No | Yes |
| Add, remove and change the role of members, add a team | Yes | - | - | No | No | No | Yes |
| Add or remove this project as a team's default project | Yes | - | - | No | No | No | Yes |
| Edit the project's name, description, Role on arrival and logo | Yes | - | - | No | No | No | Yes |
| Delete the project | Yes | - | - | No | No | No | Yes |
| Leave the project | - | - | - | Yes | Yes | Yes | Yes |
- A workspace Admin who is in both projects can move an order between them whatever their project role.
- Control data appears only when Terrabit has enabled it for your workspace, and customers cannot download or open the files. See Control data.
- No customer, Admins included, can edit the workspace name, description or logo. Contact your Terrabit account manager.
Controls you cannot use
A control your role cannot use stays on screen, greyed out, with a tooltip saying why:
| Tooltip | Who can use the control |
|---|---|
| "Workspace admins only." | Workspace Admin |
| "Project managers and workspace admins only." | Project Manager or workspace Admin |
| "Workspace viewers cannot create projects." | Workspace Admin or Member |
| "You cannot change your own role." | Another workspace Admin |
| "You do not have permission to edit this project." | Project Editor, Approver or Manager |
| "You do not have permission to approve orders" | Project Approver or Manager |