Roles & Permissions

Roles & Permissions

How Roles Work

Every team member is assigned exactly one role per membership. The role determines which actions they can perform. Roles exist at two levels:

• Agency roles — control access to agency-level features (subaccount management, agency settings, billing)
• Subaccount roles — control access to subaccount features (contacts, documents, forms, automations, etc.)

The Full Access Role

Every agency and subaccount starts with a Full Access role that has all permissions enabled. This role is automatically created and cannot be deleted. When new entity types are created, their permissions are automatically added to all Full Access roles.

Creating Custom Roles

Go to Roles in the sidebar and click New Role. Configure:

• Name — display name (required, max 255 characters). A URL-friendly slug is auto-generated.
• Description — optional explanation of what this role is for (max 1,000 characters)
• Permissions — select individual permissions from the available groups (at least one required)
• Require Two-Factor — when enabled, members assigned this role must have 2FA enabled to access the account

Subaccount Permissions (48 permissions in 14 groups)

• Contacts (6) — view, create, edit, delete, import, export
• Documents (6) — view, create, edit, delete, send, void
• Templates (4) — view, create, edit, delete
• Forms (4) — view, create, edit, delete
• Form Submissions (3) — view, delete, export
• Automations (5) — view, create, edit, delete, toggle (activate/deactivate)
• Tags (4) — view, create, edit, delete
• Entity Types (4) — view, create, edit, delete
• Custom Fields (2) — view, manage
• Records (4) — view, create, edit, delete
• Team (3) — view, invite, manage
• Roles (4) — view, create, edit, delete
• Settings (2) — view, manage
• Reports (2) — view, export

Agency Permissions (24 permissions in 6 groups)

• Subaccounts (6) — view, create, edit, delete, suspend, access
• Agency Team (3) — view, invite, manage
• Agency Roles (4) — view, create, edit, delete
• Agency Settings (2) — view, manage
• Branding (2) — view, manage
• Billing (2) — view, manage

Dynamic Permissions

When you create a custom entity type, four additional permissions are automatically created (view, create, edit, delete) and added to the Full Access role. These appear in the Roles page under the entity type’s name.

Permission Checking

Permissions are checked at multiple levels:

• Controllers — every endpoint checks the user’s active membership for the required permission before processing
• Policies — record-level authorization checks both permission and tenant ownership
• Frontend — sidebar navigation and action buttons are hidden when the user lacks the required permission