Roles, permissions and who can see what
Running a workspace · nineloops support
The five roles, how per-person permissions work on top of them, and where the rules are enforced.
Every workspace has five roles. On top of the role, you can grant or remove specific abilities for one person, so someone gets exactly what they need and nothing more.
- Owner. Full control, including billing and transferring ownership.
- Admin. Manages members, apps and workspace settings.
- Manager. Runs the work and the people in it, without workspace-level administration.
- Editor. Creates and changes records in the apps they can reach.
- Viewer. Reads without changing anything.
Change someone's access
- Open Settings, then Members.
- Find the person and change their role, or open them to adjust individual permissions.
- To see the whole picture at once, open Settings, then Roles and permissions, which shows the permission matrix by role.
Where the rules actually run
Permissions are enforced in the database itself with row level security, not merely hidden in the interface. The rule runs on the server for every read and every write, so it holds no matter how the data is reached. If you suspend or remove a member, they lose access on their very next request rather than at their next sign-in.
Separation of duties
Some areas go further than roles. In Finance, the person who raises a bill cannot approve it, and the person who approves it cannot be the one who releases the payment. A bill with no recorded approver cannot be paid by anyone. In HR, sensitive fields such as bank, tax and identity details are masked, and every time someone reveals them the read is recorded.
More in Running a workspace
Still stuck?
Raise a ticket and a person who works on nineloops will pick it up.
<a href="/support">All support articles</a>