Roles & permissions
Four roles — admin, strategist, writer and viewer — plus external users, and what each one can reach.
On this page
The four roles
| Role | What they can do | Settings & team |
|---|---|---|
| Admin | Everything, in every workspace the organization owns | Yes — Team, Billing, Branding, API, audit log; invites, roles and tab access |
| Strategist | Everything inside a workspace: prompts, runs, content, workflows, grids | No Settings, cannot change the roster |
| Writer | Content only | No |
| Viewer | Read-only everywhere; action buttons are hidden rather than disabled | No |
The rule the whole app uses is simply that everyone except a viewer can write.
Writer is a content-only role
A writer is locked to Overview, Articles, Article Prompts, Onboarding (Brand Voice) and Grids. That set is fixed — an admin's per-member tab checklist doesn't widen or narrow it.
External collaborators
External isn't a fifth role; it's a flag on a person who was invited to specific workspaces. They keep whatever role you gave them inside those workspaces and see nothing else: no dashboard, no workspaces list, no settings.
Organization role vs workspace role
Roles are set at the organization, but a workspace membership can carry its own role, and for viewers and for anyone outside the workspace's organization that one wins. An admin of their own organization invited into your workspace is not an admin there.
Admins and strategists in the owning organization see every workspace it owns; viewers and external users see only the ones they were explicitly added to.
Billing can override role
Write access depends on the subscription as well as the role. An organization in demo mode, past its trial, or cancelled collapses to read-only for everyone, admins included, until a plan is picked. The message is the same either way: view-only access, ask an admin to make changes.