The Unobits platform
Roles and permissions
Owner, Admin, Manager and Member; permission presets; module view and manage grants; and the owner-sensitive permissions nobody inherits by role.
On this page
Every member of an organization has one role. On top of the role, the Owner (or an admin with the right to do so) can grant individual permissions, either one at a time or as a preset for a job. A few powerful permissions are owner-sensitive: no role includes them, so they only exist where the Owner has granted them.
The four roles#
| Role | In short | Opens by default |
|---|---|---|
| Owner | The person who created the organization. Holds every permission, including all owner-sensitive ones. There is one Owner. | Everything |
| Admin | Runs the workspace day to day. | View and manage Socials, Ads, Projects, CRM, Reach, Web Elements, Inventory, Client Portal and Team Portal; view Finances, Digital Twin and Reports; create, edit and disable users; create and edit groups; the Admin area in the sidebar |
| Manager | Sees across the business, changes little. | View Socials, Ads, Projects, CRM, Reach, Web Elements, Reports, Client Portal and Team Portal; read users and groups |
| Member | Does their own work. | Their personal areas (Inbox, Chat, Email, Calendar, Files, Office, Whiteboards, Automations, Integrations), messaging, and submitting expense claims |
Every role can open the personal areas and submit expense claims. Company modules — CRM, Finance, Projects, Inventory, Reach and so on — need a View permission to open and a Manage permission to change.
Owner-sensitive permissions#
These are never included in a role. The Owner grants them to specific people:
| Permission | Allows |
|---|---|
| Access admin console | Open and use the organization admin console |
| Manage permissions | Grant or revoke route and action permissions |
| Manage organization settings | Change company-wide settings and security rules |
| View audit trail | Read security-sensitive admin and compliance logs |
| Delete users · Delete groups | Permanently remove people or groups |
| Manage room/group membership · Delete conversations for everyone | Change who is in shared conversations; delete them for all participants |
| Manage Finances | Create or edit invoices, bills, accounts and financial records |
| Approve bills · Approve expenses | Approve bills for payment; approve or reject expense claims |
| Manage Web Elements | Control the web builder and publish to your sites |
| Manage shared integrations · Disconnect shared integrations | Configure or remove organization-wide connections |
Presets#
A preset is a starting set of permissions for a common job. Applying one gives the person its role and grants its permissions; you can then add or remove individual permissions.
| Preset | Role | What it opens |
|---|---|---|
| Designer | Member | Projects, Web Elements and Client Portal (view and manage); Reports (view) |
| Accountant | Member | Finances (view and manage), Inventory and Reports (view); approve bills and expenses; export reports |
| Manager | Manager | Projects and CRM (view and manage); Reach, Ads, Reports and both portals (view); read users and groups |
| Developer | Member | Projects, Web Elements and Digital Twin (view and manage); Reports (view) |
| Marketer | Member | Socials, Ads, CRM, Reach and Web Elements (view and manage); Reports and Client Portal (view) |
| Virtual Assistant | Member | CRM (view and manage); Socials, Projects and both portals (view) |
| Sales | Member | CRM (view and manage); Reach and Reports (view) |
| Support | Member | Socials, CRM, Projects and both portals (view) |
| Operations | Member | Projects, Inventory and Digital Twin (view and manage); Reports and Team Portal (view) |
| Executive | Manager | View across every company module including Finances; export reports; read users |
| Delegated Admin | Admin | The admin console for users and groups, without the owner's most sensitive controls |
| Custom | Member | Nothing — start blank and grant only what is needed |
Presets that include owner-sensitive permissions (Accountant, for example) can only be fully applied by the Owner.
Grant or change permissions#
Open Admin → People and select the person.
The details panel shows their identity, role, the company routes they can open, their explicit permissions and their storage.
Choose Full editor to change their role, preset, groups or individual permissions.
Save. The change applies on their next request — search, Donna and every module follow it immediately.
The organization-wide view — which roles and people can open which company areas — is in Admin → Access. See Route access, presets and approvals.
Approvals#
When the plan includes delegated admin, admins other than the Owner can run parts of the console. Changes that belong to the Owner — to organization settings, the plan, or someone's permissions — can be raised as an approval request with a note. The Owner sees pending requests in Admin → Access, and approves or rejects each one with a decision note. Nothing in the request takes effect until it is approved.
How permissions reach the rest of the product#
Permissions are enforced by the server, not only by hiding buttons:
- Search only returns records from modules you can view.
- Donna has your permissions, no more. If you cannot open Finance, neither can she on your behalf. See Donna and permissions.
- Connections on a record only list the linked records you are allowed to see.
- Office live fields bound to CRM or Finance data only fill in for readers who can see that data.
Reference#
Every permission key, with its role defaults, is listed in the Permissions reference. Module-specific detail is on each module's permissions page, for example Finance permissions and CRM permissions.
- Change roles and permissions
- Owner, or anyone granted Manage permissions (owner-sensitive)
- Delegated admin for non-owners
- Pro and Enterprise
- Where
- Admin → People, Admin → Access