Roles in Settings

Settings → Roles & Permissions (PEOPLE & ACCESS) lists every role in the workspace, its permission count, type (system vs custom), and status. Only administrators (ADMIN role or admin permission) see the full management UI; others see an access-restricted message.

Create and edit open a full-page editor (/dashboard/settings/roles/new or /dashboard/settings/roles/:roleId) with a searchable permission catalog — not only a dialog.

Please note:

• System roles are protected — you can duplicate them but not edit or delete them.
• Inactive roles remain in the list but should not be assigned to new members.
• Permission labels are resolved from /api/roles/permissions (resource.action keys from the backend catalog).
• Permissions only matter for enabled modules — review Enable and manage modules before editing roles.
• Pair role design with Start modules per role and Home page and sidebar preferences.

KPI widgets

Widget	Shows
Total Roles	All roles in tenant
Active Roles	Roles with isActive true
System Roles	Built-in protected roles
Custom Roles	Tenant-created roles

Role table tabs

Filter with All, Active, Inactive, System, or Custom. Search matches display name, internal name, or description.

Column	Content
Role	Icon badge, display name, internal name
Description	Short summary or em dash
Permissions	Count plus preview of first two permission labels
Type	System (lock icon) or Custom
Status	Active (green) or Inactive
Created	Formatted creation date
Actions	Duplicate; Edit/Delete for custom roles only

Common actions

Action	Availability	Result
Create Role	Admins	Opens full-page Create role editor
Edit Role	Custom roles only	Opens full-page Edit role editor
Duplicate Role	All roles	Clones permissions to a new custom role
Delete Role	Custom roles only	Permanent removal after confirm
Export	Admins	JSON download of all roles
Import	Admins	JSON upload; creates or updates custom roles

Import notes: existing roles with the same name are updated; system roles cannot be modified by import.

Permission editor

On the role page:

1. Search the catalog; disabled-module permissions appear under Module restricted but stay searchable
2. Toggle resource.action keys; the save button shows the selected count (Save role (N))
3. For employee access, enable one of the labeled permissions below, then open Fields ›:
   • View employees (choose sections and fields) → panel Employee fields
   • View profiles of people who report to you (choose sections and fields) → Direct report fields
   • Edit own employee profile (choose sections, fields, and optional approval) → Own profile fields (+ Require approval)
4. In the panel: Search fields…, Select all / Clear, section checkboxes, and Custom sections for employee custom fields
5. New roles often default-include home.people_feed for Home celebrations / welcome cards
6. Use templates when available to seed a job-shaped permission set

Full walkthrough of section lists, plain vs restricted semantics, and approver types: Limit employee sections, fields, and self-edit approval. Also grant Table reports hub keys (reports.read / reports.create / reports.export.*) when needed.

Assign roles to people

Roles take effect when assigned on Manage members. For conceptual RBAC (modules vs permissions, reviews), read Roles, permissions, and RBAC.

flowchart TB
  Catalog[Permission catalog] --> Editor[Full-page Create or Edit Role]
  Editor --> Nested[Optional field section pickers]
  Editor --> Custom[Custom role with permissions]
  System[System roles] --> Duplicate[Duplicate to custom]
  Duplicate --> Custom
  Custom --> Assign[Assign on Members tab]
  System --> Assign
  Assign --> Effective[User effective access]

Related articles

• Limit employee sections, fields, and self-edit approval — Fields panels and approvers
• Manage employees and profiles
• Manage members — assign roles to users
• Manage teams — team structure alongside RBAC
• Home page and sidebar preferences
• Settings drawer overview
• Workspace security checklist
• Add users and invite teammates