Rights and groups matrix
Rights and groups matrix
Who can read this: anyone. Who can act on it: you need the Manage Members right to change other people's access, and the Owner right for the items marked owner below.
This is the one place that defines what each right does. Other chapters link here instead of restating it.
1. The rights
A right is a permission attached to a person or a group, on the whole space or on one item (folder, document, table, form…). The labels below are exactly what the Rights column in Users and rights shows.
Label in the UI | What it allows | Includes | Notes |
|---|---|---|---|
Owner | Everything, including managing access | Every other right | Granted one person at a time in the Users tab, never in bulk invite. Only an owner (or a platform administrator) can give or take away this right, for a person or for a group. A space must always keep at least one owner |
Read | See the item or the table's rows | — | The base for everything else |
Comment | Add comments on rows and documents | Read | |
Fill fields | Fill a document's fields and comment, without editing the text | Read, Comment | Used for reviewers |
Edit | Change content and rows | Read, Comment, Submit | Uses an editor seat (see §4) |
Submit | Submit a form without needing edit rights on the table behind it | Read | Lets customers fill a form without touching the data |
Chat | Use the AI assistant on this item | — | |
AI Jobs | Start long AI jobs (generate a document, run a recipe) | — | Separate from Chat because long jobs cost more |
Manage Members | Add and remove people, grant access (every right except Owner), invite from a staff table | — | |
Manage External Users | Invite, block and relink portal users | — |
|
Manage Working Calendar | Edit working calendars (weekends, holidays) | — | |
Billing | Marks the one person this space is billed to | — | You cannot tick it in the rights picker; use Bill this project to me under Billed to |
Not every dialog offers every right:
Users and Group rights (space level) offer Owner, Read, Edit, Submit, Chat, AI Jobs, Manage Members, Manage External Users and Manage Working Calendar. Comment and Fill fields are not offered there, and Billing is hidden.
The per-item Manage access… dialog offers Read, Comment, Edit, Submit and Manage. Here the Owner right is labelled Manage. Fill fields is not offered.
The bulk Invite members grid leaves out Owner and Billing.
Public access is not a right
Anonymous visitors have no row in the access list and no right. A page is public only when the item is published and the space is published. If you see only one owner in the access list, that can still be a fully public space. To stop public access, unpublish.
2. Invite roles
Invite members offers three presets over the rights above. Changing any individual right switches the row to Custom.
Role | Rights it sets | Takes an editor seat |
|---|---|---|
Read-only | Read | No |
Editor | Read, Edit, Submit, Chat, AI Jobs | Yes |
Admin | Editor rights + Manage Members, Manage External Users, Manage Working Calendar | Yes |
Admin is not Owner: an admin cannot delete the space, clear its data, export it, or open Automations (see §3).
Careful: Manage Members lets a person add and remove people and grant every right except Owner. Adding Owner to anyone's rights (their own included), taking it away, removing a person who holds it, or changing a group whose rights include it needs the Owner right yourself, or the platform administrator right. Without it the save is refused: "Only a project owner can grant or remove the Owner right. Ask an owner to make this change." So an Admin can run the team but cannot make themselves, or anyone else, an owner. Manage Members still decides who can open the space, so give it to people you trust with your data.
3. What each level can do in the space menu
Capability | Minimum right |
|---|---|
Edit space settings (name, slug, features) | Owner |
Users and rights, External Users, External Portals, Start screen, Inbound Messaging, Live Chat, Backups, Audit log | Manage Members |
Give or take away the Owner right (on a person or a group), or remove a person who holds it | Owner, or a platform administrator. Manage Members alone is not enough |
Working Calendars | Manage Working Calendar |
Automations | Owner |
Export / Import, Duplicate project, Clear tables data, per-table Clear table data…, module install and import, scheduled imports (Repeat automatically) | Owner |
Export a table to CSV or XLSX (Data menu) | Read. Hide a column if its values must not be exported |
Taking over billing (Bill this project to me) | Owner |
Undo from the Data change log | Edit on the table. Undo from the Audit log needs Manage Members and Edit on each target document |
Delete Space | Owner and the person the space is billed to (or the platform administrator) |
Agents, Asset Library (changes) | Edit |
Add, change or delete a table's columns | The Owner right on that table (labelled Manage in the per-table Manage access… dialog). Edit lets you change rows, not the structure |
Inbox: view | Read |
Inbox: reply, start a message, assign, set status or follow-up, Analyse | Edit |
Inbox bot and channel settings | Manage Members |
Connectors: add, change, test, run | Owner |
Run a rule from a table's Run button or a Button column | Edit on the space and Edit on the table. Preview needs space Edit only |
See a rule's configuration, run history, limits, retry and undo | Owner. Editors see only the rules they can run, without configuration |
Agent AI provider panel (your own AI key) inside Agents | Manage Members |
External users access… on an item (portal sharing and what customers see) | The item's creator, a space Owner, or a platform administrator. Manage Members alone is not enough |
Data change log | Any member, but each person sees only the tables they can read |
The full list, with what each item opens, is the .
4. Seats
Only people who can edit use an editor seat. Read-only members are free. Inviting someone who already edits elsewhere on your account costs nothing extra. Seats are counted from each person's own Edit or Owner grants, across all spaces billed to the same account. Rights held only through a group are not counted. If an invite would exceed your plan, Invite members shows how many seats it needs and how many remain, and rejects the extras: downgrade some people to Read-only or upgrade the plan.
5. Groups
Rights can go to a person or to a group. In Users and rights, the Groups tab creates, renames and deletes groups and lists members; Group rights assigns rights to a group.
A member of a group gets everything the group is granted, plus anything granted to them directly. Removing someone from a group does not remove their direct rights.
Revoking or deleting a group asks for confirmation and lists who loses access.
The Groups tab creates internal groups. Create groups for portal users under External Users. Adding a person to a group needs an existing account.
Inside a group, a member is either a Manager (sees the whole group's rows) or a Member (sees only their own rows). Click the badge to switch.
6. Inheritance and restriction
Access flows down the folder tree. An item with no rules of its own inherits from its parent, and ultimately from the space.
Restrict access on an item cuts inheritance: only the people and groups listed on that item can open it and what is inside it.
Project owners and platform administrators cannot be restricted this way.
Publish in the external portal is a separate switch per item, in External users access…. A folder exposes its whole subtree. An unexposed item is invisible to portal users even if a group has rights on it.
Manage access… on an item can be opened by the item's creator, a space Owner, or a platform administrator. Manage Members alone is not enough.
7. Narrowing inside a table
For your team
On a table's Manage access… dialog, two more tabs narrow what team members see. Both are always bypassed by space owners, administrators and the table's creator.
Tab | What it does |
|---|---|
Row visibility | Turn on Limit which rows people can see. Then a person sees a row only if they created it, are named in a chosen person column, or are in a group that manages someone who is. Full-access groups (for example, financial controllers) see every row |
Column visibility | Per column, choose Everyone (with row access), Specific groups, or Nobody (hidden), separately for read and write |
If you turn on row visibility and select no rules, everyone outside the full-access groups sees no rows. The screen warns you.
For customers (portal users)
Customers are scoped from External users access… on the table, under What they see:
Row filter decides which rows a customer gets. A table with no rule is refused, not shown in full.
Column visibility decides which columns they get. Once you have saved it for the external audience, new columns are hidden from customers by default. Before the first save, the tab warns that saving will close new columns.
The team tabs above do not scope what customers see. This includes Row visibility: the portal never reads it. Customers get a table's rows only through its Row filter.
8. Rules that protect you
Situation | What happens |
|---|---|
Removing the last owner, or your own Owner right when you are the last | Refused. Grant Owner to someone else first |
Someone with Manage Members but not Owner adds or removes Owner, or removes an owner | Refused: "Only a project owner can grant or remove the Owner right. Ask an owner to make this change." |
Saving a grant with no rights ticked | Refused. To remove access, remove the entry |
Removing your own access | Asks to confirm. Only another owner can restore it |
Leaving a space you pay for | Refused. Transfer billing first |
Removing the person the space is billed to | Refused. Billing is shown to owners only; move it first |
Leaving a demo space | Not offered. Use Hide from my list |