Skip to main content
The platform separates who you are in the company from what you can touch. Company roles set the floor; resource permissions raise it for specific items; and access cascades from a resource to everything derived from it.

​
Company roles

Every member of a company has exactly one role: Roles are assigned from Settings → Team. Only Owner and Admin can change them.

​
Resource permissions

On top of the company role, individual resources carry their own access list. Almost everything you can name is a permissionable resource: Each grant has a level: Levels are strictly ordered: viewer < editor < admin. A grant can be given to an individual member or to a group. A group grant reaches every member of the group.

​
How the layers combine

The platform computes your effective level on any resource by taking the highest access any of these paths gives you:
  1. Owner short-circuits every check—no resource grants needed.
  2. A direct grant to you on the resource.
  3. A grant to any group you belong to.
  4. An inherited grant from a parent or container—see Permission inheritance.
If none of those apply, you have no access. Access is additive: there is no “deny” grant. To take access away, remove the grant (or the group membership, or the parent grant) that provides it.

​
Auto-grants on create

Whoever creates a project or a database gets an Admin grant on it automatically. They keep that grant until someone with Admin on the resource (or an Owner) revokes it.

​
Manage permissions

From the resource’s settings panel (the shield icon on a project, database, entity, app, file collection, or integration), use the Access panel to:
  • Add a member or group at a chosen level.
  • Change an existing grant.
  • Revoke a grant.
The panel has two sections. Members lists direct grants you can edit. Also has access lists everyone who reaches the resource indirectly—through a parent, a group, or a data link—and shows where each came from. See Permission inheritance. Only Owners and members with Admin on the resource can manage its permissions.

​
Next

  • Permission inheritance — how a grant cascades to everything derived from a resource.
  • Groups — grant access to many members at once.
  • Attributes — describe members, then drive groups and policies from those values.
  • Row-level security — control which rows inside a database or entity a member can see.