Summary
You give access to a workspace by adding members, each with a role: viewer, editor or owner. That role applies to every project in the workspace — and any project can override it for someone, including hiding the project from them entirely.
This page assumes server mode
Accounts, roles and access rights only exist with a backend. In the browser, working alone on your own machine, the question does not arise — see Deployment modes.
The roles
A workspace member is given one of the three roles Viewer, Editor or Owner. A fourth, No access, exists on a project only. From the most restricted to the broadest:
No access (hidden) — on a project only
The project is hidden. This role is not given on the workspace: it is an override, to take one specific project away from someone without touching the rest.
Viewer
Reads dashboards, cohorts, documentation. Changes nothing. This is the role for people you present work to.
Editor
Creates and changes content: projects, cohorts, datasets, dashboards, code. The role for those who produce the work.
Owner
All of the above, plus running the workspace: adding and removing members, changing its settings, deleting it.
Inheritance into projects
This is what saves you from configuring every project separately: a role given on the workspace applies in all of its projects. Adding someone as an editor makes them an editor everywhere.
That default suits most teams. When it does not, a project can override someone’s role: the override wins over inheritance, for that project only. It is set in the project settings, Members tab, with Add override; Remove override gives the person back their inherited role.
Workspace
Alice — workspace role
EditorTwo common overrides
A workspace viewer becomes an editor on the one project they actually work on.
An editor drops to no access on a project whose data is closed to them — the project then disappears from their view.
Custom roles
The shipped roles cover most situations, but their boundaries are not always your institution’s. So an administrator can, in the instance settings, Roles tab, create roles and choose precisely what they allow, resource by resource: Read, Write, Delete, and Execute where code runs (IDE, widgets, analyses).
What a member can do inside a workspace. These roles also apply to every project in the workspace by inheritance — a project can override a member's role (see the project's Members tab).
| Permission | Owner System | Editor System | Viewer System | Data manager |
|---|---|---|---|---|
| Workspace | ||||
| Workspace settings | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Workspace members | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Projects | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Databases | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Project | ||||
| Project members | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| IDE | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Execute | ||||
| Cohorts | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Dashboards | ||||
| Read | ||||
| Write | ||||
| Delete | ||||
| Execute | ||||
By default, the Viewer reads everywhere; the Editor reads, writes and executes everywhere, but deletes nothing and does not manage members; the Owner has everything.
Roles come in two scopes that should not be confused.
- Workspace and project role — what a member can do inside a workspace. That is the one this page is about.
- Global role — what a person can do to the instance: manage accounts, manage the roles themselves, change configuration. See Authentication and permissions.
System roles can be edited, not deleted
Viewer, Editor and Owner carry the System badge: you can rename them and change their permissions, not delete them — all inheritance rests on them. Changing their boxes therefore changes what every member holding them can do, in every workspace.
A custom workspace role cannot be assigned yet
The matrix accepts custom workspace roles, but the members’ role menu currently offers only Viewer, Editor and Owner (and No access on a project). A custom global role, on the other hand, is assigned to an account — see Authentication and permissions.
Going further
- Settings — the other workspace settings.
- Authentication and permissions — accounts and global roles, on the administration side.