---
title: "Roles & Permissions"
description: "Every team role and what it can see and do in your workspace."
category: "Workspace & security"
updated: 2026-10-14
canonical: https://approvethis.com/docs/manuals/roles-permissions
---

# Roles & Permissions

Every team member is assigned a role that controls what they can see and do in your workspace.

| Role | Access Level | Best For |
|------|-------------|----------|
| **Owner** | Full access (permanent) | Team creator |
| **Administrator** | Full access + billing | Senior managers, workspace admins |
| **Manager** | Workflows, groups, requests | Department heads, team leads |
| **User** | Submit & approve requests | Most team members |
| **Read-Only** | View everything, change nothing | Auditors, stakeholders |
| **Requester** | Submit requests, see only their own | Contractors, external submitters |
| **External Approver** | Approve assigned items only | Clients, vendors, outside stakeholders |

---

## Permission Matrix

| Resource | Owner | Admin | Manager | User | Read-Only | Requester | External |
|----------|:-----:|:-----:|:-------:|:----:|:---------:|:---------:|:--------:|
| **Groups: Create/Edit/Delete** | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **Groups: View** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ |
| **Workflows: Create/Edit/Delete** | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **Workflows: View** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ |
| **Requests: Create** | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | ❌ |
| **Requests: Edit** | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| **Requests: View** | ✅ | ✅ | ✅ | ✅ | ✅ | Own only | Assigned only |
| **Requests: Delete** | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **Approvals: Approve** | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | ✅ |
| **Approvals: View** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | Assigned only |
| **Dashboard: Access** | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
| **Billing: Manage** | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **Integrations: Manage** | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |

---

## Key Rules

- The **Owner** always has full permissions and cannot be removed from the team.
- **Administrators** can approve any request, even ones not assigned to them.
- All other roles can only approve requests they are specifically assigned to.
- **Requesters** are restricted to the "My Requests" view and cannot see other team members' requests.