Built-In Roles
Every member has one main role, and you can add more roles on top. A member can do whatever their combination of roles allows. You manage roles in Setup > Roles, and you need to be an Owner or Admin to change anyone's access.
Main roles
Pick one main role for each member when you invite them.
Role | What it allows |
|---|---|
Owner | Everything an Admin can do. Only an Owner can make, change, remove or reinstate another Owner. |
Admin | Manages the workspace: its people, roles and setup, with every feature. |
Member | Belongs to the workspace and can view it. Anything more comes from their other roles. |
Viewer | Views every lease, premises, party and document they can reach. Changes nothing. |
Legal | Views everything except lease accounting, and edits leases, legal entities and contacts. No access to Setup. |
Integrations Admin | Opens Setup and connects other systems, such as an ERP. Can't change who has access. |
Owners and Admins can do every part of a process, including posting journal entries and locking periods. An Admin can change or remove another Admin, and every workspace needs at least one Owner.
Additional roles
Add a role on top of the main one when someone needs extra rights across the whole workspace. We ship these, and any role you build yourself can be added the same way.
Role | What it allows |
|---|---|
Controller | Runs the books: every lease accounting ability, with read-only access to leases and premises. |
Integration Setup | Connects systems: Setup access, AI clients and workflow automation. Nothing contractual. |
Combining roles
Roles add up, and we don't block any combination. Keep each person to the access they need. Before you give someone Legal and Controller together, check whether one person should be able to both edit a lease and post its accounting, or both post and lock a period.
Posting journal entries and locking periods always apply to the whole workspace, across every reporting entity. You can't limit them to one region, country or entity. Give them only to the people who close the books for every entity, and use placements to keep everyone else's access to their region.
Roles we don't ship
There's no built-in lease administrator or payables role. Build one yourself as a custom role from the individual permissions.