Roles and permissions

What each role can see and do, how to give someone access to one budget, and how to limit what a person sees.

A role decides what someone can do across the workspace. Access on one budget can add to that; data restrictions narrow it.

Roles

Role	Typically	Can
Admin	Finance lead	Everything: integrations, GL mapping, team and roles, audit log, setup.
Analyst	Finance team	Create, edit and approve budgets; work with actuals, datasets and projections; follow the setup checklist.
Reviewer	Department heads, managers	Read budgets, budget vs actuals and dashboards; comment; ask Co-Pilot.
Board Member	Board, investors	Read dashboards, budget vs actuals and projections.
Guest Viewer	Anyone else	Read the dashboards shared with them.

Someone can hold more than one role. Admins can also create custom roles on the Roles tab.

Contributors

A contributor is not a role. It is anyone without the budgets list who has a department sheet to fill in, usually a Guest Viewer. They see Assigned sheets and nothing else of the budget. See Filling in a sheet.

Invite someone

Admins can invite people:

1. Open Settings › Team & permissions, go to the Invitations tab and click Invite member.
2. Enter their Email address, pick a Role and click Send invitation.
3. Once they join, set their Department on the Members tab.

Share one budget

On a budget, open the ⋯ menu and choose Manage access. Add a person, a role or a department at one of four levels:

Level	Can
Viewer	Read.
Commenter	Read and comment.
Editor	Change figures and mapping.
Admin	Everything, including access and status.

The budget’s owner always has admin access. Draft budgets are private to the owner and finance until shared.

Limit what someone sees

On the Members tab, click Data access next to a person and turn on Limit to selected values of a dimension, such as one entity or a few departments. They then see only data for those values. Choosing a value includes everything under it.

Restrictions narrow, roles grant. A restriction never gives someone a page their role does not allow.