Workspace roles
Each user has a workspace role that dictates their workspace access and allowed permissions.
- Users will need the Admin workspace role to manage other users' roles.
A user’s role determines what activities they can do in the workspace, and what permissions they are allowed to have on different resources. It also determines their billing status.
Who can manage roles?
Only Admins can add new workspace members and edit users' workspace roles. Admins can configure workspace roles for individual users, allowed domains, and directory sync.
Types of workspace roles
Every user in a workspace is assigned one of the following roles: Admin, Manager, Editor, Viewer or Guest.
| Capability | Admin | Manager | Editor | Viewer | Guest |
|---|---|---|---|---|---|
| View all Projects, Components, and Collections | ✔ | ||||
| Access workspace settings to manage users, groups, and billing | ✔ | ||||
| Grant themselves Full Access to projects and components | ✔ | ||||
| Update metadata (status, categories, title description) of projects they can view | ✔ | ✔ | |||
| Use endorsed statuses | ✔ | ✔ | |||
| Create and duplicate projects, components, and collections | ✔ | ✔ | ✔ | ||
| Use the Hex API | ✔ | ✔ | ✔ | ||
| Access projects shared with workspace | ✔ | ✔ | ✔ | ✔¹ | |
| Access projects shared with them explicitly | ✔ | ✔ | ✔ | ✔¹ | ✔ |
¹Users with the Viewer role can only be granted up to Can View access
How is the Guest role different?
Guests are similar to Editors in that they can be granted up to Full Access permissions on projects and components. However, Guests also differ from Admin, Editor, and Viewer workspace roles in a few key ways:
- Guests do not receive access to resources or assets that are shared with the workspace. Guests can access only projects and components shared with them as individuals.
- Guests cannot view users or groups in workspace settings.
- Guests cannot create new projects or components in the workspace.
What role is granted by a project invite?
Existing users
When an existing user is invited to a project in your workspace, they will keep their existing workspace role. Recall that Viewers are restricted to Can View and below project permissions. So, if a Viewer is invited to a project with Can Edit or Full Access permissions, they will be downgraded to Can View, unless an Admin promotes them to Editor.
New users
When a new user is invited to a project in your workspace, by default they will receive the Guest workspace role. However, a user invited to your workspace via project invite could recieve the Viewer, Editor, or Admin role in either of the following cases:
- The user's email address matches an allowed domain for the workspace.
- The user's email address matches the workspace's directory sync.
In these cases, the user will receive the workspace role specified by the allowed domain or directory sync configuration.
Workspace roles and paid seats
Users with the Admin or Editor workspace roles are considered "Paid Author Seats". Users with the Viewer workspace role are considered "Viewer Seats", which may be free or paid depending on your pricing plan.