Getting started
Roles and permissions
Updated September 8, 2026
What a teammate can see and do in a workspace comes from two things: their workspace role, and any per-job custom permissions layered on top of it.
The built-in roles
| Role | Can do | Typical holder |
|---|---|---|
| Owner | Everything, including billing and deleting the workspace | Founder or HR lead |
| Admin | Manage jobs, the team and settings — not billing ownership transfer | Ops or people manager |
| Viewer | Read-only across jobs, candidates and reports | Stakeholder without recruiting duties |
| Custom | A per-job permission set built from individual grants | Interviewer or contractor scoped to one hire |
Custom permissions are set per job, not per workspace
A Custom teammate has no default access — every capability, from viewing a candidate's CV to leaving a scorecard, is granted individually against a specific job. This is the right shape for an external interviewer who should see exactly one pipeline and nothing else in the workspace.
Removing someone from a job's custom permission list takes effect immediately and only affects that job. It doesn't touch anything they can already see through a workspace-level role.
Changing a teammate's role
Team settings → select the teammate → change their role. The change applies the moment it's saved, no re-invite needed, and is recorded in the audit trail with who made it and when.
Was this page clear?Report an error in this page