Roles
The four roles in an organization, what each is for, and who can assign them.
Every member of an organization holds one role there: Owner, Admin, Member or Viewer. A role is a named set of permissions. The overview, and how roles apply to API keys and connected apps, is in Roles and permissions. This page is the reference for what each role holds and who may assign it. The permission-by-permission list is the permission matrix.
What each role is for
- Owner holds every permission. It is the only role that can edit organization settings, delete the organization, manage billing and deactivate members.
- Admin holds every permission except those four. Admins set up the newsroom's connections, credentials, templates and brand kits, manage API keys and members, and can read the activity log and usage.
- Member does the editorial work. Members create, edit and run data sources, edit newsdesks, pitches and stories, and push stories to NRCS, CMS and social accounts. They can see who else is in the organization. Members cannot delete data sources, manage connections or API keys, or read the activity log or usage.
- Viewer can read. A viewer can look at the newsroom's data sources, newsdesks, pitches and stories but cannot change or push anything. A viewer can also read the organization's settings, which a member cannot. Like a member, a viewer cannot read the activity log or usage.
Who can assign roles
You choose a role when you invite someone, and you can change it later. Both need the right
permission: Invite members (member:invite) for an invitation, Change member roles
(member:change-role) for an existing member. Owners and admins hold both.
Owners keep control of ownership:
- Only an owner can invite someone as Owner, promote a member to Owner, or change or remove an existing owner.
- An organization always keeps at least one owner. Changing the role of the last owner, or removing them, is refused.
How members and invitations are managed is in Members and invitations.
A role takes effect immediately
When someone's role changes, it applies from their next request, in every surface. Signed-in people and connected apps are checked against their current role each time; an API key is not, because it carries its own permissions (see API keys).