Roles and permissions
Three layers of roles: the organisation's (Owner to Guest), the account's (billing, security), and each workspace's (Viewer to Owner). Which take a seat.
On this page
A person has one organisation role, which says what they administer, and one workspace role in each workspace, which says what they do with its diagrams. A few people also hold an account role for billing or security. Viewers and Commenters are free; Contributors, Editors and workspace Owners take a seat. Administrators see no diagram content through their role alone.
Organisation roles
Set in Organisation…, Members, column Role.
| Role | What it allows |
|---|---|
| Owner | Everything below, plus giving and taking the Owner, Security administrator and Auditor roles. The organisation keeps one owner at least, two on Enterprise. |
| Security administrator | The organisation's rules: the Assistant and what it reads, the review policy, sessions and tokens. |
| Workspace administrator | Workspaces, members and invitations. Never acts on an owner, a security administrator, an auditor or an account role holder. |
| Auditor | Reads the audit log and exports the list of members. No diagram content. |
| Member | Works in the workspaces where they have a role. |
| Guest | Sees only what is shared with them, views or comments, on diagrams up to Internal. Hidden from the directory. |
Account roles
Set in Organisation…, Account roles, by an owner: An account role counts only for an active member of Claims Architecture.
| Role (as the app shows it) | What it allows |
|---|---|
| Owner | The account itself: its name, its roles. |
| Billing | The plan, seats, credits and invoices. Receives access requests forwarded to billing. |
| Security | The account's baseline security rules and the AI. |
| Identities | Domains, single sign-on and SCIM. These have no screen yet: see Set up single sign-on. |
| Auditor | Reads the account, without changing it. |
Workspace roles
Set per workspace: when you invite someone, in People of the workspace…, or by the workspace's default role.
| Role | Can | Seat |
|---|---|---|
| Viewer | See the diagrams. | free |
| Commenter | Comment, and give a verdict when asked to review. | free |
| Contributor | Edit diagrams, create them, request a review. | takes a seat |
| Editor | Edit and share. Editors are the default approvers of a review. | takes a seat |
| Owner | Everything, plus the workspace's people and settings. | takes a seat |
A member's access to a diagram is the higher of their workspace role and any access shared with them on that diagram.
The approver
Approver is not a role you give: it is the part a person plays in one review, when the author asks them. Any person who can comment on the diagram can be asked. See Request a review.
Rules that always hold
- No content through administration. Owners and administrators do not open a diagram through their organisation role. A Restricted diagram opens only for its owner, the workspace's owners and the people invited.
- Nobody makes themselves a workspace owner. Another owner names them.
- Removing a member passes their diagrams to an active owner of each workspace; their name stays in the history.
- A guest made from a member keeps Commenter roles only.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.