Roles and access
Where to change roles: Operator console → Team & access
Two things decide what someone can do in your workspace:
- Their role: what they can do anywhere in the workspace, and whether they use a builder seat.
- Folder and item access in the Portal (View, Edit or Manage): which dashboards and queries they can do it to. Access set on a folder applies to everything inside it; an item can be limited to fewer people.
The roles
There are five roles. Each includes everything the one below it can do.
| Role | Builder seat | Lands in | What they can do |
|---|---|---|---|
| Admin | Yes | Portal (Console if Embed only) | Everything: people and roles, billing, usage, the audit log, embedding, security, and how the workspace is used. Creates the top-level Team content folders and can open and manage all Team content. |
| Modeler | Yes | Portal | Everything a Builder can do, plus the Business Model and publishing datasets. Adds connections from inside Business Model. No Operator console. |
| Builder | Yes | Portal | Everything an Explorer can do, plus building dashboards. Organizes Team content where they have Edit or Manage. New dashboards they build land in their My content. |
| Explorer | Yes | Portal | Everything a Viewer can do, plus Query Builder (all its features) and My content: keeps their own items and shares them with others to view. |
| Viewer | No, free and unlimited | Portal | Opens the dashboards and saved queries they've been given access to, answers prompts, changes filters, exports, and keeps favorites. |
| Pending | No, free | Portal (waiting) | Nothing yet. Everyone who joins starts here until an Admin gives them a role. |
What each role can do
| Admin | Modeler | Builder | Explorer | Viewer | |
|---|---|---|---|---|---|
| Open Portal content they have access to | All | ✓ | ✓ | ✓ | ✓ |
| Export data | ✓ | ✓ | ✓ | ✓ | ✓ |
| My content | ✓ | ✓ | ✓ | ✓ | |
| Build dashboards | ✓ | ✓ | ✓ | ||
| Use Query Builder | ✓ | ✓ | ✓ | ✓ | |
| Organize Team content (where they have Edit) | ✓ | ✓ | ✓ | ||
| Create top-level Team folders | ✓ | ||||
| Connections and Business Model | ✓ | ✓ | |||
| Operator console | ✓ | ||||
| Billing, usage and audit log | ✓ | ||||
| Embedding, people, security | ✓ |
Good to know
- Seats: Admins, Modelers, Builders and Explorers each use one builder seat from your plan. Viewers and Pending people are free.
- Billing and Auditor roles were retired. Admins handle billing, usage and the audit log. Anyone who had one of those roles is now Pending until an Admin assigns a new role.
- Viewers and Explorers can only be invited when the workspace includes internal reporting (Team & access → How this workspace is used).
- Viewers can't edit. Even if a folder gives them Edit, a Viewer can only view.
- My content is private. Admins can't see someone's My content unless it's shared with them.
- New people wait for a role. Someone who joins your organization without an invite appears on Team & access under "Waiting for a role" and can't open anything until an Admin assigns one.