Guide Workspace & security

Roles & Permissions

Every team role and what it can see and do in your workspace.

Updated

Admin
Open ApproveThis

Every team member is assigned a role that controls what they can see and do in your workspace.

Role Access Level Best For
Owner Full access (permanent) Team creator
Administrator Full access + billing Senior managers, workspace admins
Manager Workflows, groups, requests Department heads, team leads
User Submit & approve requests Most team members
Read-Only View everything, change nothing Auditors, stakeholders
Requester Submit requests, see only their own Contractors, external submitters
External Approver Approve assigned items only Clients, vendors, outside stakeholders

Permission Matrix

Resource Owner Admin Manager User Read-Only Requester External
Groups: Create/Edit/Delete ✅ ✅ ✅ ❌ ❌ ❌ ❌
Groups: View ✅ ✅ ✅ ✅ ✅ ✅ ❌
Workflows: Create/Edit/Delete ✅ ✅ ✅ ❌ ❌ ❌ ❌
Workflows: View ✅ ✅ ✅ ✅ ✅ ✅ ❌
Requests: Create ✅ ✅ ✅ ✅ ❌ ✅ ❌
Requests: Edit ✅ ✅ ✅ ✅ ❌ ❌ ❌
Requests: View ✅ ✅ ✅ ✅ ✅ Own only Assigned only
Requests: Delete ✅ ✅ ✅ ❌ ❌ ❌ ❌
Approvals: Approve ✅ ✅ ✅ ✅ ❌ ✅ ✅
Approvals: View ✅ ✅ ✅ ✅ ✅ ✅ Assigned only
Dashboard: Access ✅ ✅ ✅ ✅ ✅ ❌ ❌
Billing: Manage ✅ ✅ ❌ ❌ ❌ ❌ ❌
Integrations: Manage ✅ ✅ ❌ ❌ ❌ ❌ ❌

Key Rules

  • The Owner always has full permissions and cannot be removed from the team.
  • Administrators can approve any request, even ones not assigned to them.
  • All other roles can only approve requests they are specifically assigned to.
  • Requesters are restricted to the "My Requests" view and cannot see other team members' requests.