Roles & Permissions

Workestra uses Role-Based Access Control (RBAC) so workspace owners can grant exactly the right level of access to each member — no more, no less.

How it works in one paragraph

Every member gets one or more roles. Each role is a bundle of permissions like crm.contact.export or finance.invoice.send. Each granted permission has a scope — all (everyone in the workspace), team (the user and the people who report to them, recursively), or own (only records they personally own). When a member holds multiple roles, the most permissive scope wins. On top of that, Owners control which modules each member can even open — a workspace can pay for the Projects module but only grant access to the engineering team.

Built-in roles

Workestra ships with five built-in roles. They're a starting point — clone any of them to make a custom role.

Owner

The highest level of access. Holds every permission in the catalog, including the locked owner-only ones (billing, workspace deletion, ownership transfer, member impersonation).

The Owner role can be assigned to multiple users. Workspace creators get it automatically.

Admin

Full administrative access without the owner-only "red list".

Best for: IT administrators, department heads, operations leads.

Manager

Operational access scoped to the manager's team — the people who report to them, walked recursively through the manager chain. A regional manager who has team leads under them sees the team leads' team data too.

Best for: Sales managers, recruiting leads, project leads, support team leads.

Member

Standard individual contributor. Can do their own work; can't see colleagues' records or manage anything.

Best for: Sales reps, recruiters, project contributors, support agents.

Viewer

Read-only across the entire workspace. No creates, no edits, no deletes.

Best for: Executives, auditors, accountants, read-only stakeholders.

Multi-role assignment

A member can hold multiple roles at once. Effective permissions are the union of every assigned role, with the most permissive scope wins.

Example: Sara is both a Sales Rep (custom role: crm.deal.list at team scope) and a Recruiting Coordinator (custom role: ats.candidate.list at team scope). She sees her sales team's deals and her recruiting team's candidates — without anyone needing to build a third hybrid role.

To add a role to a member:

1. Go to Settings → Administration → Members.
2. In the Roles column, click the + button on the member's row.
3. Pick a role from the popover. The badge appears next to the existing roles.
4. To remove a role, click the × on the role badge (only available when the member has more than one role — can't remove their last role).

Per-user module access

Even if a workspace pays for the Projects module, the Owner can grant access to it only to the people who need it. A 50-person agency might subscribe to all six modules but expose Finance only to the accounting team.

To manage a member's module access:

1. Go to Settings → Administration → Members.
2. In the Modules column, click the 5/13 (or similar) chip on the member's row.
3. Tick or untick modules in the popover. Changes apply immediately.

New invites get every module enabled by default. You can change the default for new invites under workspace administration.

Permission scopes — all, team, own

Every grant on a role carries a scope. When you create or edit a custom role, you pick the scope per permission.

When a member holds multiple roles that grant the same permission, the most permissive scope wins (all > team > own).

Custom roles

Custom roles are how you adapt Workestra to your organization's actual job titles.

Creating a custom role

1. Go to Settings → Administration → Roles.
2. Click Create Role.
3. Enter a name (e.g. SDR — outbound only) and an optional description.
4. Use the search box and module tabs to find the permissions you want.
5. Tick each permission and pick its scope (all / team / own).
6. Save.

The catalog has 867 permissions across 18 namespaces — workspace, CRM, ATS (recruiting), projects, support, finance, people, analytics, telephony, email, knowledge, time, automations, AI, integrations, audit, sequences, platform. Use the module tabs to narrow down.

Sample sector roles

Editing or deleting a custom role

1. Go to Settings → Administration → Roles.
2. Click the role name to edit.
3. Modify permissions and click Save. Changes apply immediately to every member who holds the role.
4. To delete: click Delete and reassign affected members to another role first.

Built-in roles (Owner, Admin, Manager, Member, Viewer) cannot be deleted.

Permission requests

When a member tries to do something they don't have permission for — for example, exporting contacts as a Member who lacks crm.contact.export — they can click Request access instead of being silently blocked. The request lands in the admin inbox.

As a member: requesting access

1. When you hit a denied UI surface, look for the Request access button (usually next to the lock icon).
2. Pick the scope you actually need (own is usually the most likely to be approved).
3. Optionally add a reason — a quick justification helps admins decide quickly.
4. Submit. You'll get a notification when an admin approves or rejects.

As an admin: triaging requests

1. Go to Settings → Administration → Permission Requests.
2. The Pending tab shows new requests with the requester, the requested permission, the requested scope, and any reason they wrote.
3. Click Approve or Reject. You can add a note that the requester will see.
4. Approved requests automatically grant the permission via a per-user Custom Grants role — no need to edit a global role for one-off accommodations.

Manager hierarchy

Set up your reporting structure so team-scoped permissions resolve correctly.

1. Go to Settings → Administration → Members.
2. In the Manager column on each row, pick the person that member reports to.
3. The chain is walked recursively — a member with three layers above them (rep → team lead → regional manager → VP) is correctly included in the VP's team scope.

Members with no manager set are top-level (only their own data, plus anyone who reports to them).

What gates the UI

Workestra hides or disables UI elements based on the caller's permissions. You'll see:

• Hidden — buttons, menu items, or whole pages disappear when the caller lacks the permission.
• Disabled with tooltip — sometimes the button stays visible but is greyed out, with a tooltip naming the missing permission. Click it to open a Request access dialog.
• Empty state with CTA — when a list is empty because the caller can't see any records, the empty state offers a Request access button.

Best practices

Principle of least privilege

Grant the minimum each role needs. It's much easier to add a permission via a request later than to remove an over-granted one without breaking workflows.

• New stakeholders → start with Viewer.
• Active contributors → Member (own scope).
• Anyone managing a team → Manager (team scope).
• IT/operations leads → Admin.
• Reserve Owner for the founders / C-level.

Use scopes, not custom roles, for "same job, different territory"

If your sales team is split into "EU Reps" and "US Reps" with the same permissions but different data, don't create two custom roles. Set up the manager hierarchy correctly and use team scope on a single Sales Rep role — each rep automatically sees only their own region.

Quarterly access review

Once a quarter:

1. Settings → Administration → Members — scan for users with elevated roles they no longer need.
2. Settings → Administration → Roles — review custom roles for relevance; merge or retire ones you're no longer using.
3. Settings → Security → Audit Log — check for permission grants and Owner-only actions.
4. Remove access for departed teammates promptly.

Document custom roles

For each custom role, write a one-line description that answers:

• What is this role for?
• Who should have it?
• When should they get upgraded or downgraded?

The description is visible on the Roles admin page and helps anyone joining the workspace understand the model without having to inspect grants.

---

Next steps

• Members & teams — invite people and assign roles.
• Audit log — review permission grants and access changes.
• Data & privacy — export and deletion for compliance.