Admin & Security
Understand and review workspace access
Distinguish roles, component permissions, department scope and access to an individual record.
ExplanationFor administrators and team managersContent reviewed
On this page
Access has several parts#
| Part | What it controls |
|---|---|
| Workspace capability | Whether the feature is available in this organization. |
| Component permission | Whether a person can read, write or administer an area. |
| Department or management scope | Which organizational context the grant covers. |
| Record access | Whether a particular project, document or other record is accessible. |
| Workflow authority and state | Whether this person can perform the next decision now. |
A role name alone does not explain all these checks. A reporting relationship or designation is not a universal administrative grant.
Review a missing action#
- Confirm the affected account and the exact task.
- Record the page, target record and action that is missing or refused.
- Check that the workspace has the feature enabled.
- Have an authorized administrator review the relevant component permission and scope.
- Check the target record's ownership, department and sharing.
- Review any workflow-specific authority or state restriction.
- Ask the person to retry with their own account after the intended correction.
Grant the access needed for the task. Do not use broad administration as the default fix for a single inaccessible record.
Examples of separate responsibilities#
- A document can be readable through sharing without being editable or deletable.
- Payroll preparation, approval and payment instruction have separate authorities.
- Bank viewing, editing and verification are separate responsibilities.
- A team member can submit leave while another authorized person reviews the decision.
Check the result#
The person can perform the intended task within the intended scope. Confirm that the correction did not expose unrelated departments or sensitive records.
When people join or change roles#
Review access when someone joins, changes responsibilities or leaves. Keep invitation setup separate from subsequent permission changes. Use Invite an employee for account onboarding.
Developers can inspect their own permissions through the Permissions API guide. The server remains responsible for enforcing each request.
See Understand and review workspace access on the product site
Need more help?
Can’t find what you need? Talk to the team.
To report a problem with this guide, include its title and the step that blocked you.