Roles & Access Control
How organization roles and project roles combine to decide what each person can do in 8090 Software Factory.
8090 Software Factory decides access with two independent layers. Your organization role says who you are across the whole organization. Your project role says what you can do inside a single project. Both are checked on every action.
The two layers
| Layer | Roles | What it governs |
|---|---|---|
| Organization role | View, Member, or Admin | Organization-wide abilities, and which project roles you can be given. |
| Project role | Viewer, Editor, Owner, or a custom role | What you can do inside one project. |
Access to a project's content is governed by your project role, not your organization role. Being a Member of the organization grants nothing inside a Private project until someone assigns you a project role. Internal projects are the exception.
Read each layer in detail:
How access is decided
View members hold Viewer access only
Someone with the View organization role can only be given the Viewer project role or a Viewer-compatible custom role. A Viewer-compatible custom role has a base of No Access or Viewer and sets no module to Editor.
8090 Software Factory rejects any other assignment, whether you add the person to a project, change their project role, or invite them. It also rejects edits that would add Editor access to a custom role a View member holds. To give someone more than Viewer access, first change their organization role to Member, which moves them to a Full seat.
Organization Admins act as Owner everywhere
An organization Admin has Owner access on every project, even projects they were never added to. The project's member list shows only people who were added to the project, so an Admin who wasn't added doesn't appear there. An Admin who was added appears as Owner with an Admin badge, and that role can't be changed. Removing an Admin from a project's member list doesn't remove their access.
The project creator is an Owner
Whoever creates a project becomes its Owner. A project can have more than one Owner. The last Owner can't be removed or given a lower role, so assign another Owner first. Only people assigned the Owner role count toward this rule. An Admin's automatic Owner access doesn't.
Internal projects give everyone Viewer access
When a project's visibility is Internal, every active organization member can open it with Viewer access, even without a project role. If someone has been given a role on the project, that role applies instead, including a custom role with less access. See Project visibility.
Access only ever adds
Roles build access up, they never subtract it. A built-in role gives a fixed bundle of permissions. A custom role starts from a base and layers module access on top. There is no way to revoke a single permission below a base, so to give less, start from a lower base.
An agent can never do more than the person driving it
Every agent action runs as the person who triggered it and inherits exactly that person's permissions. If you cannot do something by hand, the agent cannot do it for you. Automations run with their author's permissions, and any restriction placed on an automation can only narrow what it may create or edit, never widen it. This is why a View-seat person can never use an agent to act above Viewer.
What a denied action looks like
- A module you cannot open shows You don't have access to this module in the navigation. If you follow a link into it, the page shows Access Needed.
- When an agent action needs access you don't hold, the agent reports what is missing, for example: "This action requires Editor access to Work Orders. Ask a project owner to assign a role that includes it."
- Controls for actions your role doesn't allow are disabled or hidden.
Where roles are managed
Every organization member can open Settings → Organization → Manage Roles to read the Built-in Project Roles and Custom Role Definitions. Only organization Admins can create, edit, and delete custom roles. Project roles are assigned in each project under Settings → Members & Roles.
Related
Next, learn about Organization roles.