Skip to main content
On this page, we will walk you through workspace roles and the permissions related to each role. There are four workspace roles:
  1. Admin
  2. Manager
  3. Editor
  4. Viewer
Your role applies to the current workspace. You can have a different role in another workspace.

​
Workspace role permissions

The following table shows the tasks available to each workspace role when your system role is User. Where the table says Team access, you also need access to the relevant team or ownership of the personal item. Personal dashboards and their charts are accessible only to their owner, including when you are a workspace Admin, system Admin or System Admin. The tasks available to you also depend on your plan and enabled features. Workspace support is available in the interface only when support is enabled in your environment.

​
How workspace and team roles work together

  • A workspace Viewer cannot gain editing permissions from a higher team role. Chart results can be visible even when the catalog and chart-building workbooks are unavailable.
  • Workspace Editors and Managers need the appropriate team role to edit team content. Manager does not automatically grant ownership of every team or permission to invite workspace members.
  • A workspace Admin has administrative access to teams in that workspace, regardless of their team role.
  • A system Admin or System Admin overrides workspace and team role restrictions. See System roles.
For example, a system User with workspace Editor and team Viewer can view that team’s dashboards, but cannot edit them. A workspace Viewer with a team Editor role still cannot edit team dashboards.

​
Current permission exceptions

The following exceptions currently apply:
  • As a Viewer, you can create charts through the API and preview charts at workspace level. To preview a chart within a specific dashboard, you need team editing permission.
  • You only need workspace Editor or higher to remove a workspace member.
  • You need workspace Editor or higher to load workspace details through the Auth API. Viewer requests are denied.
These exceptions do not change the permissions required to use Graphbuilder or edit existing charts.

​
Public workspaces

A signed-in system User who is not a member can enter a public workspace as a Viewer. Making a workspace public does not grant editing permissions or make every private team accessible. An existing member keeps their assigned workspace role.

​
Catalog access

Assigning a catalog determines which catalog is available in the workspace; it does not change a user’s role. A Viewer does not become an Editor when you assign a catalog. Selecting a default catalog determines which catalog loads first when building new queries. Your workspace and team roles determine whether you can view an existing chart. Selecting a catalog does not replace these permissions. See Assign a system catalog to a workspace.
Last modified on October 22, 2026