Workspace roles
Each user has a workspace role that dictates their workspace access and allowed permissions.
This is a new role for less technical users to dig into data and build their own no-code analyses. Explorers can create explorations from apps or warehouse tables to learn more about a campaign, a product behavior, or sales figure.
The Explorer role is only available on Team and Enterprise Plans.
- Users will need the Admin workspace role to manage other users' roles.
A user’s role determines what activities they can do in the workspace, and what permissions they are allowed to have on different resources. It also determines their billing status.
Types of workspace roles
Every user in a workspace is assigned one of the following roles: Admin, Manager, Editor, Explorer, Viewer or Guest.
- Admins — Own workspace configuration, access, and governance
- Managers — Endorse assets and contribute to workspace governance
- Editor — Build and edit notebooks and data apps in projects
- Explorer¹ — Build explorations and explore data apps
- Viewer — Find and access data apps
- Guest — Ad-hoc access to Hex
¹Only available on Team and Enterprise plans.
| Capability | Admin | Manager | Editor | Explorer | Viewer | Guest |
|---|---|---|---|---|---|---|
| View all Projects, Components, and Collections | ✔ | |||||
| Access workspace settings to manage users, groups, and billing | ✔ | |||||
| Grant themselves Full Access to projects and components | ✔ | |||||
| Update metadata (status, categories, title description) of projects they can view | ✔ | ✔ | ||||
| Use endorsed statuses | ✔ | ✔ | ||||
| Create and duplicate projects, components, and collections | ✔ | ✔ | ✔ | |||
| Use the Hex API | ✔ | ✔ | ✔ | |||
| Schedule project runs | ✔ | ✔ | ✔ | |||
| Build, save, and share explorations | ✔ | ✔ | ✔ | ✔ | ||
| Subscribe to conditional notifications | ✔ | ✔ | ✔ | ✔ | ||
| Access projects shared with workspace | ✔ | ✔ | ✔ | ✔ | ||
| Access projects shared with them explicitly | ✔ | ✔ | ✔ | ✔ | ✔ | |
| Access & use data apps shared with them explicitly | ✔ | ✔ | ✔ | ✔ | ✔² | ✔ |
| Access & use data apps shared with the workspace | ✔ | ✔ | ✔ | ✔ | ✔² |
²Users with the Viewer role can only be granted up to Can View access
Who can manage roles?
Only Admins can add new workspace members and edit users' workspace roles. Admins can configure workspace roles for individual users, allowed domains, and directory sync.
Workspace roles and paid seats
Users with the Admin, Manager, or Editor workspace roles are considered "Paid Author Seats". Users with the Explore workspace role are considered “Paid Explorer Seats”. Users with the Viewer workspace role are considered "Viewer Seats", which may be free or paid depending on your pricing plan.
How is the Guest role different?
Guests are similar to Editors in that they can be granted up to Full Access permissions on projects and components. However, Guests also differ from Admin, Manager, Editor, and Viewer workspace roles in a few key ways:
- Guests do not receive access to resources or assets that are shared with the workspace. Guests can access only projects and components shared with them as individuals.
- Guests cannot view users or groups in workspace settings.
- Guests cannot create new projects or components in the workspace.
What role is granted by a project invite?
Existing users
When an existing user is invited to a project in your workspace, they will keep their existing workspace role. Recall that Viewers are restricted to Can View and below project permissions. So, if a Viewer is invited to a project with Can Edit or Full Access permissions, they will be downgraded to Can View, unless an Admin promotes them to Editor.
New users
When a new user is invited to a project in your workspace, by default they will receive the Guest workspace role. However, a user invited to your workspace via project invite could receive the Viewer, Editor, Manager, or Admin role in either of the following cases:
- The user's email address matches an allowed domain for the workspace.
- The user's email address matches the workspace's directory sync.
In these cases, the user will receive the workspace role specified by the allowed domain or directory sync configuration.