How roles work
Built-in roles, custom roles, and how to create your own.
A role is a saved bundle of permissions. Each member of your organisation has one or more roles, and the app uses them to decide what each person can see and do.
The five built-in roles
These ship with every organisation. They're locked, you can duplicate them, but you can't edit or delete them.
| Role | Best for |
|---|---|
| Owner | Founders. Full power, including the ability to promote other Owners. |
| Admin | Trusted operators. Same as Owner minus org-deletion / billing. |
| Manager | Team leads. Can manage clients, projects, leads, and team members' tasks. |
| Member | Default for individual contributors. Their own tasks, files, teams, meetings, chat and the Nova assistant, and nothing else. |
| Developer | Engineers who need the developer tools and API keys, plus tasks, files, teams, the Users page and the Nova assistant. |
If you're not sure which to assign, Member is a safe starting point, you can always add another role later.
A Member does not see clients, projects, invoices, payments, quotes, leads, inventory, other members' contact details or organisation passwords. They work on the tasks they are given and talk in chat. To let someone see more, add a role that grants it (for example Manager, or a small custom role such as Invoice Sender). Project members do not see a project's passwords automatically either, share the passwords with them instead (see Passwords).
Anyone with Developer Access can create API keys, and an API key can read and change everything in the workspace. Give it only to people you trust with full access, and note that a developer can change or revoke only the keys they created themselves (Owners can manage every key).
Creating a custom role
If the built-in roles don't fit, build your own.
- Open Dashboard → Roles.
- Click New Role (top-right of the left panel).
- Type a name and pick a colour. Click Create.
- The role opens in the right panel with all permissions off. Toggle the ones you want.
- Click Save.
The permission list is grouped by feature area (Tasks, Files, Teams, Chat, Users, etc.). Each row has a label, a description, and a switch.
Switches you can't toggle are greyed out, you don't have that permission yourself, so you can't grant it to others. Ask an Owner or Admin. The same rule applies when you edit, rename or delete a role, or take a role from a member: you can only do it to a role whose every permission you hold yourself.
Editing or duplicating an existing role
- Click the role in the left panel.
- Locked roles show their permissions read-only. Use Duplicate to copy the role into an editable one.
- Custom roles are fully editable, change the name, colour, or any permission, then Save.
Deleting a custom role
Open the role and click Delete. Members who had it will lose those permissions (but not access entirely, if they had other roles too). The five built-in roles cannot be deleted.
Assigning a role to a member
- Open Dashboard → Members.
- Click the pencil icon (or Manage Roles action) on the member.
- Tick or untick role checkboxes. You can pick more than one, see Multiple roles, what does that mean?.
- Click Save.
Permissions you'll need
Creating, editing, deleting, or assigning roles all require the Manage Roles permission, which Owners and Admins have by default. The Roles page itself opens for people with Manage Roles or Manage Members (people who add members need to see the role list); anyone else sees an "Access Denied" page.