Per-member permissions

Roles provide the defaults

A workspace role starts a member with a set of capabilities, such as reading contacts, writing conversations, publishing social posts, or managing integrations. A per-member override adds or removes one capability for one person in one workspace. It does not change the role for anyone else or grant access to another workspace.

Edit one member's permissions

1. Open Team in the workspace and find the member.
2. Select Permissions. Checked items show what they can currently do after any overrides.
3. Tick a capability to add it, or untick one to take it away.
4. Select Save permissions. The member's row shows how many changes differ from their role defaults.

Use Reset in the dialog to return the selection to the role defaults before saving. Changes are stored relative to the role, so a later role change clears them rather than carrying an old exception into a different role.

Limits on overrides

• You need member-management permission and a higher workspace role than the person you are editing.
• You cannot give someone a capability you do not have yourself.
• Workspace deletion is Owner-only and cannot be granted as an exception.
• Basic workspace access cannot be unticked; remove the membership to withdraw access.
• Owner permissions cannot be reduced through per-member overrides.

Review effective access

Navigation follows read permissions, while write and publish controls are checked separately. For example, removing Payments read hides the Payments section; giving Social read alone does not let someone publish. Revisit overrides when a person changes responsibilities, and use Client access for a customer-facing checklist.