Roles & Permissions

Roles & Permissions (/settings/roles) is where you "Define what each role can do. Changes take effect on the next request for every assignee." The left list holds every role with a count of how many permissions it grants; select one to edit its matrix on the right. Assign these roles to people on the Team Members screen.

Create or clone a role

+ New role opens the New role dialog ("Create a custom role. Optionally start from an existing role's permissions, then fine-tune them."). Type a Role name (the page derives a CUSTOM_... key live) and, optionally, Clone permissions from an existing role — or leave it Start empty. Choose Create role; the new role is selected automatically, ready to edit.

Edit the permission matrix

Permissions are grouped into collapsible categories, each showing a granted/total count. Click any permission cell to cycle it through the three states:

• – Not set — the role neither grants nor blocks it.
• ✓ Allowed — explicitly granted.
• ✕ Denied — explicitly blocked (deny wins over allow).

Per category, Allow all, Deny all, and Clear set every cell at once, and a Search permissions… box filters the list. Nothing is saved until you choose Save changes; afterward a confirmation reads "Saved — affects N users." so you can see the blast radius.

System roles are read-only

Built-in roles show "System role — read-only. Clone it to a custom role to edit permissions." — the cells and bulk actions are disabled. To change one, clone it into a custom role first, then edit the copy.

Related

• Team Members — assign roles and record access to people
• Settings reference