> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adriel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and access

> Limit which workspace members and teams can see each connected data source on their dashboards.

Two layers of access control determine what a workspace member can see and do:

1. **Workspace role** — what a member can do across the workspace (view only, edit, admin).
2. **Per-source access** — which connected data sources show up on the member's dashboards.

Use per-source access when an agency, client, or external partner should only see their own accounts.

## Workspace roles

Roles are assigned during invitation and editable later by workspace admins. See [Workspaces, teams & roles](/workspace-and-access/workspace-concepts) for the role glossary in full.

| Role              | What it can do                                                                                                                                |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Admin**         | Full access. Sees every connected source regardless of per-source assignment. Can manage members, edit permissions, and edit any data source. |
| **View and edit** | View and edit dashboards. Sees only the sources assigned through the Members tab.                                                             |
| **View only**     | Read-only access to dashboards. Sees only the sources assigned through the Members tab.                                                       |

Workspace owner bypasses all per-source restrictions — same effective access as Admin.

<Note>
  Custom workspaces may have additional roles defined by their account team. Contact Adriel for details on custom role configurations.
</Note>

## Set per-source access

<Steps>
  <Step title="Open the source's settings">
    Navigate to **Data sources**, find the source in the list, and click the settings icon on the row.
  </Step>

  <Step title="Open the Members tab">
    The settings drawer has tabs along the top. Click **Members**.
  </Step>

  <Step title="Pick an access mode">
    Three modes are available:

    * **Everyone** — every current and future workspace member sees this source on their dashboards. Default for newly connected sources.
    * **Select all** — every current member and team is selected explicitly. Differs from **Everyone** because future members are not automatically added.
    * **Specific** — pick individual members or teams from the list.
  </Step>

  <Step title="Add members or teams">
    Use the search bar to find members by email or teams by name. Click to add. Selecting a team locks the individual checkboxes for its members and labels them as inherited from the team.
  </Step>

  <Step title="Save">
    Click **Save**. The change applies immediately — members who lost access stop seeing the source on next dashboard load; new members see it as soon as they refresh.
  </Step>
</Steps>

## Modes at a glance

| Mode           | Best for                                           | What happens when a new member joins |
| -------------- | -------------------------------------------------- | ------------------------------------ |
| **Everyone**   | Internal sources visible to the whole workspace    | Automatically added                  |
| **Select all** | Locking the current member list as the access list | Not automatically added              |
| **Specific**   | Agency / client setups, partner restrictions       | Not automatically added              |

## Teams vs. individual members

Adding a team gives access to every current and future member of that team. Individual members already in the team show as inherited — their checkbox is locked and labeled accordingly. Removing a member from the team also removes their access to the source, unless they were also added individually.

Use teams for stable groups (a marketing team, an agency pod) and individual selection for one-off exceptions.

## Who can edit per-source access?

| Workspace role      | Can edit the Members tab |
| ------------------- | ------------------------ |
| **Workspace owner** | Yes                      |
| **Admin**           | Yes                      |
| **View and edit**   | No                       |
| **View only**       | No                       |

If a member without edit rights opens the Members tab, the controls are visible but disabled.

## Related controls

Per-source access controls which **sources** a member can see in widgets. Two related controls limit different things:

<CardGroup cols={2}>
  <Card title="Teamspace access & members" href="/workspace-and-access/teamspace-settings#members">
    Control which members and teams can access a teamspace, independent of the sources behind them.
  </Card>

  <Card title="Managing members & access" href="/workspace-and-access/managing-members">
    Add members, change workspace roles, organize into teams.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="A member can't see data after being added to a source">
    Check that: (1) the member's invitation status is **Connected** — pending invites don't have access yet; (2) the source is set to **Specific** with the member individually added or in an added team; (3) the member's workspace role isn't restricting access at the folder level. If all three look correct, ask the member to refresh the dashboard.
  </Accordion>

  <Accordion title="A member sees a source they shouldn't have access to">
    The most common cause is that the source is set to **Everyone** rather than **Specific**. Change to **Specific** and add only the intended members or teams. Admin and workspace owner always see every source regardless of this setting.
  </Accordion>

  <Accordion title="The Members tab is disabled">
    The current user doesn't have permission to edit per-source access. Workspace Admins and the workspace Owner can. Ask a workspace admin to make the change.
  </Accordion>

  <Accordion title="Want to lock the current member list before inviting more people">
    Switch the source from **Everyone** to **Select all**. The current list is captured explicitly. New members invited later won't automatically gain access — add them individually if needed.
  </Accordion>
</AccordionGroup>