Access in a workspace is decided by a role. A role is a named set of permissions, and every Seat Holder holds exactly one role at the workspace level.
Roles live at Settings → Roles.
Every role has one of two scopes, and the scope determines which permissions it can contain.
| Scope | Applies to | Permission set available |
|---|
| Organization | The workspace as a whole | Every category except Team-Specific |
| Team | One team’s membership | The Team-Specific category only |
A role’s scope is fixed when it is created and cannot be changed afterwards.
Eight roles are created automatically when a workspace is provisioned. They are marked System in the list, and they cannot be edited or deleted.
| Role | Permissions |
|---|
| Owner | ADMIN_FULL_ACCESS |
| Admin | ADMIN_FULL_ACCESS |
| Member | ORG_VIEW, USERS_VIEW, TEAMS_VIEW, GROUPS_VIEW, BOARDS_CREATE, REPORTS_VIEW, ACTION_ITEMS_MANAGE, INTELLIGENCE_VIEW, SIGNALS_VIEW, INTEGRATIONS_VIEW |
| Participant | ORG_VIEW, TEAMS_VIEW, INTELLIGENCE_VIEW |
| Internal | INTERNAL_ADMIN — reserved for the ScatterSpoke team |
| Role | Permissions |
|---|
| Team Admin | TEAM_FULL_ACCESS |
| Team Member | TEAM_CREATE_BOARDS, TEAM_VIEW_REPORTS, TEAM_MANAGE_ACTION_ITEMS |
| Team Watcher | TEAM_VIEW_REPORTS |
ADMIN_FULL_ACCESS and TEAM_FULL_ACCESS are wildcards: holding either satisfies every permission check in its scope, so the individual keys need not also be present.
Each permission carries a tier tag shown as a badge in the role editor. The tag describes the plan level at which the underlying capability is available; it is a property of the permission, not of the role.
| Key | Grants | Tier |
|---|
ORG_VIEW | View workspace details and settings | Free |
ORG_EDIT | Modify workspace name, branding, and settings | Free |
ORG_MANAGE_BILLING | View and manage billing, invoices, and the subscription | Free |
| Key | Grants | Tier |
|---|
USERS_VIEW | View the workspace user list and profiles | Free |
USERS_INVITE | Send invitations | Free |
USERS_MANAGE | Edit roles, deactivate, or remove users | Free |
| Key | Grants | Tier |
|---|
TEAMS_VIEW | View the team list and membership | Free |
TEAMS_CREATE | Create new teams | Free |
TEAMS_MANAGE | Edit team settings, add and remove team members | Free |
| Key | Grants | Tier |
|---|
GROUPS_VIEW | View the group hierarchy and membership | Free |
GROUPS_CREATE | Create new groups | Pro |
GROUPS_MANAGE | Edit groups and manage group members | Pro |
| Key | Grants | Tier |
|---|
BOARDS_CREATE | Create retrospective boards | Free |
BOARDS_MANAGE | Edit or delete any board in the workspace | Free |
REPORTS_VIEW | Access reports and analytics dashboards | Free |
REPORTS_EXPORT | Export report data to CSV or PDF | Pro |
ACTION_ITEMS_MANAGE | Create, edit, and close action items | Free |
| Key | Grants | Tier |
|---|
SURVEYS_CREATE | Create and distribute surveys | Pro |
SURVEYS_MANAGE | Edit, close, or archive surveys | Pro |
SURVEYS_VIEW_RESULTS | Access response data and analytics | Pro |
| Key | Grants | Tier |
|---|
INTELLIGENCE_VIEW | Access AI-generated insights and signal events | Free |
INTELLIGENCE_ASK | Query workspace data with Ask | Pro |
INTELLIGENCE_DIRECTIVES | Create and manage leader directives | Pro |
| Key | Grants | Tier |
|---|
SIGNALS_VIEW | View signal events and trends | Free |
SIGNALS_MANAGE_RULES | Create and edit custom signal detection rules | Pro |
| Key | Grants | Tier |
|---|
INTEGRATIONS_VIEW | View configured integrations | Free |
INTEGRATIONS_MANAGE | Configure third-party integrations | Pro |
| Key | Grants | Tier |
|---|
NETWORK_VIEW | Access organizational network analysis visualisations | Enterprise |
NETWORK_MANAGE | Configure network analysis settings and collection | Enterprise |
| Key | Grants | Tier |
|---|
ADMIN_FULL_ACCESS | Unrestricted access to all workspace features | Free |
ADMIN_MANAGE_ROLES | Create, edit, and delete custom roles | Pro |
ADMIN_VIEW_AUDIT_LOG | Access the workspace audit log | Pro |
ADMIN_MANAGE_SSO | Configure single sign-on providers | Enterprise |
ADMIN_DATA_RETENTION | Configure data retention policies | Enterprise |
INTERNAL_ADMIN | Cross-workspace access for the ScatterSpoke team | Free |
Available only to Team-scoped roles.
| Key | Grants | Tier |
|---|
TEAM_FULL_ACCESS | Unrestricted access to all team features | Free |
TEAM_CREATE_BOARDS | Create boards within the team | Free |
TEAM_VIEW_REPORTS | Access team-level reports and analytics | Free |
TEAM_MANAGE_ACTION_ITEMS | Create and manage the team’s action items | Free |
TEAM_MANAGE_MEMBERS | Add or remove team members | Free |
TEAM_EDIT_SETTINGS | Modify team name and configuration | Free |
Custom roles are gated by the ROLES entitlement — Business and Enterprise. On Free and Pro the Roles page renders a blurred preview behind an upgrade prompt; the built-in roles above still work on every plan.
A custom role is defined by a name (up to 100 characters), an optional description (up to 500), a scope, and at least one permission. The role editor groups permissions by category with a select-all control per group.
Constraints:
- Names are unique within a scope. The same name may exist once as an Organization role and once as a Team role.
- Scope is immutable after creation. Editing a role exposes name, description, and permissions only.
- System roles are read-only. Opening one shows View Role, with no save action.
- Deleting archives. Users assigned to a deleted role lose its permissions.
Workspace-level settings pages — Workspace, Billing, Users, Branding, Integrations, Roles, SSO, and API keys — require admin access, which means holding ADMIN_FULL_ACCESS. Non-admin Seat Holders see only Profile in the settings navigation.
Admin access additionally requires being a Seat Holder. A Participant, holding no seat, has no workspace access regardless of role.
Role assignment is enforced by the API, not just the interface.
| Rule | Effect |
|---|
| Self-assignment | A user cannot change their own role |
| Admin targets | A membership whose workspace role is Admin cannot have its role changed or be removed |
| Scope match | Only Organization-scoped roles may be assigned as a workspace role |
| Workspace match | The role must belong to the same workspace as the user |
Assigning a role that includes ADMIN_FULL_ACCESS also marks the underlying membership as Admin; assigning any other role marks it as Member.
