Help Guides
Roles and permissions
A role is a named bundle of permissions. People get permissions only through roles.
Platform roles
Platform roles govern the Hub itself:
| Role | Can |
|---|---|
superadmin |
Everything |
support |
See users, turn app access on and off, read the audit log, manage tenants, see billing |
billing_admin |
Billing, refunds, the audit log, see users |
member |
Nothing beyond their own account. Everyone has it. |
The four built-in roles can't be edited or deleted. Make narrower ones in New role, for example a read-only support_readonly with just users.list and audit.view.
You can't grant more than you hold. Creating a role, or assigning one, with a permission you don't have yourself is refused.
App roles
Each Application defines its own role names (such as admin and member) and its own app.<slug>.* permissions in Permissions & roles. An app can name a default role that everyone with access holds automatically. App roles only ever grant that app's permissions.
Who has a role?
On a role's page, People with this role lists everyone it's assigned to.
Screens in this guide
ROL-01 · Roles ROL-02 · Role detail ROL-03 · New role ROL-04 · User — Roles APL-05 · Permissions & roles