Access control

Access control sets what each member of your organization can do in a project. You can set it at three levels:

• The project: whether someone can open the project at all, and whether they can manage it.
• Each product: for example, view-only access to dashboards but full access to feature flags.
• Individual items: a single dashboard, insight, feature flag or other item.

Rules can apply to everyone, to a role or to a single member.

Access control is available on plans that include Access control. Rules for roles need a plan that also includes Roles. Without these features, every member of the organization can use every project.

Access levels

For a project:

For a product, or for an individual item:

Some products don't offer every level.

Who always has full access

• Organization admins and owners have full access to every project and every item in it.
• The person who created an item always has full access to that item.

Set access for a project

You need admin access to the project to change these settings.

1. Open the project, then Settings → Project → Access control.
2. Choose a tab: Defaults for everyone in the organization, Roles for a role, or Members for one person.

Defaults

On Defaults, Default access to this project sets the level everyone in the organization gets unless a more specific rule says otherwise. Below it, set the default level for each product.

For example, to keep a project private to a few people, set the default to No access, then give those people Member or Admin on the Members tab.

Roles and members

On Roles or Members, find the role or person and select Edit. Set their access to the project and to each product. Use the filters above the list to narrow it by role, member, product or access level.

Set access for a single item

Individual items, such as a dashboard or a feature flag, can have their own rules.

1. Open the item.
2. Open the Access panel (the lock icon) in the side panel.
3. Set Default access for the item.
4. Under Members or Roles, select Add, choose who to add and at what level, then select Add again.

To take a rule away, select the remove button next to the member or role.

How rules combine

A person can be covered by several rules: defaults for everyone, rules for their roles and rules for them personally, on a product or on a single item. The most specific rule decides:

1. A rule on the item itself comes before the rules for its product.
2. Within the same item or product, a rule for the person comes first, then the rules for their roles, then the default for everyone.
3. If several of their roles have rules, the highest of those levels applies.

For example, if dashboards default to Viewer but one member has Editor on dashboards, that member can edit dashboards while everyone else can only view them.

Roles

Roles group members so you can give the same access to several people at once. Roles are managed under Settings → Organization → Roles, and they apply in every project of the organization.

To create a role:

1. Open Settings → Organization → Roles.
2. Select Add a role, enter a role name and select Create.
3. Expand the role to add members to it.

Then give the role access in each project, on the Roles tab of Access control.

Under Default role for new members, you can choose a role that every new member joins automatically, so they inherit its access as soon as they arrive.

Roles are available on plans that include Roles.