Roles and permissions

Choose a built-in role or create a custom set of workspace permissions.

Start with the access someone needs

Use a built-in role when it fits. Create a custom role when someone needs a narrower combination of actions.

Built-in roles

Roles apply within a workspace. A person can have different access in another workspace.

Role	Access
Owner	All permissions, including deleting the workspace.
Admin	Manages domains, credentials, webhooks, team, roles, workspace settings and audit logs. Can view billing, but cannot manage billing or delete the workspace.
Developer	Manages domains, credentials and webhooks; can view and export analytics and view workspace settings. Cannot manage team, roles or billing.
Analyst	Views Overview, domains, credential listings and audit logs; can export analytics and audit logs. Cannot create or change sending configuration.
Billing	Views Overview and can view and manage billing. Does not manage sending configuration or team access.

These are permission assignments; they don't imply every feature has a dashboard control. Viewing a credential listing doesn't reveal its secret.

Built-in roles are shown as system. They cannot be edited or deleted. Owner isn't assignable through an invitation or member Role dropdown, and only the actual workspace owner can delete the workspace. Creating a custom role with broad permissions doesn't make someone an Owner.

Review permissions

Open Settings → Users & Permissions → Roles. The list shows each role's name, description, type, permission count and member count.

Permissions are grouped by resource and action:

Group	Examples of access
Analytics	View or export reporting.
Domains	View, create, edit, verify or delete sending domains.
Credentials	View, create, reveal, rotate or revoke credentials.
Webhooks	View, create, edit, delete or replay webhook deliveries.
Team Members	View, invite, change roles or remove members.
Roles	View, create, edit or delete roles.
Workspace Settings	View or edit workspace settings.
Audit Log	View or export audit entries.
Billing	View or manage billing.

Some actions also require viewing the resource. For example, allowing a domain to be created includes the corresponding view permission. These view permissions are included in the effective access when the role is used.

Create a custom role

1. In Roles, click New role.
2. Enter Name and Description.
3. Select the permissions the role should have.
4. Click Create Role.

Use group selections for related actions, or choose individual permissions. Select All and Clear All change the selection across the editor; review the final selection before saving.

Creating a role doesn't assign it to anyone. Return to Users and select it for a member, or choose it when inviting someone.

Assign a role to a teammate →

Copy or edit a role

Use the copy icon to open a new role prefilled with an existing role's permissions. Give the copy a distinct name, review its access, then click Create Role. This works for built-in roles too, without changing the original.

For a custom role, click the pencil icon, update its fields or permissions, and click Save Role. The change affects every member assigned to that role, not just the person you last edited.

Delete a custom role

Check its Members count and reassign members first. Then click the trash icon and confirm Delete role. A role still assigned to users cannot be deleted. Built-in roles have no delete control.

Review role changes in Audit log →

If a page or action is missing

Your assigned permissions determine which pages, tabs and controls are available. Ask the workspace owner or administrator to review your role. After a change, reload or select the workspace again to refresh your session's access.

Best practices

• Keep custom role names descriptive, such as Delivery support.
• Review all affected members before editing a shared role.
• Grant credential, role-management and deletion actions only where needed.