Roles & access
Access is controlled by roles. Each role grants a set of capabilities — what is visible in the admin and which actions are allowed.
Roles
| Role | What they can do |
|---|---|
| Owner | Project creator. Same rights as admin, plus protection: role and status cannot be changed, account cannot be deleted. |
| Admin | Full access: schema, users, settings, content, media. |
| Editor | Content and media: creates, edits, deletes records. Cannot manage schema, users, or settings. |
| Viewer | Read-only. Does not see Users, Settings, and other admin sections. |
Owner and admin see all admin sections. Editor sees content and media. Viewer sees only read views.
Capabilities by role
| Capability | Owner | Admin | Editor | Viewer |
|---|---|---|---|---|
| Manage schema (types, fields) | yes | yes | — | — |
| Manage users | yes | yes | — | — |
| Project settings | yes | yes | — | — |
| Write data (content) | yes | yes | yes | — |
| Write media | yes | yes | yes | — |
| Manage forms | yes | yes | — | — |
| Read | yes | yes | yes | yes |
Read is available to everyone — it is not a capability, but a default right for every authenticated user.
Per-type data access
Every content type has a permission matrix — who can read, create, update, and delete records of that type. Defaults:
| Role | Read | Create | Update | Delete |
|---|---|---|---|---|
| Viewer | yes | — | — | — |
| Editor | yes | yes | yes | — |
| Admin / Owner | yes | yes | yes | yes |
The matrix can be customized per type on the Access permissions page. There you can:
- Adjust role-based rights — e.g. allow editors to delete records of a specific type.
- Set per-user rights — grant a specific user access different from their role.
Admin always has full access — this row cannot be changed.
User management
On the Users page (access: admin and owner) you can:
- Create a user (single-tenant mode): name, email, password, role.
- Invite by email (multi-tenant mode): invitation email with a link, or copy the link manually.
- Change role or status (active/inactive).
- Delete a user.
Restrictions:
- Owner’s role and status are protected — cannot be changed.
- Cannot delete yourself.
- Cannot delete the owner.
- Name and email are set at creation and cannot be changed.
What the viewer sees
A viewer sees in the sidebar: Dashboard, Content types, Media, GraphQL Playground, Access Keys. Other sections are hidden. Attempting to open a hidden section via a direct link — redirect to Dashboard with “You do not have permission for this action.”.
What’s next
- Content types & fields — per-type permissions.
- GraphQL API — reading and mutations.
- Webhooks — content events.