Roles and permissions
The six built-in roles, how to make custom ones, every permission in the catalog, and how roles work with access to workspaces and items.
A member's role decides what they can do across the organization. See every role on the Roles page in Settings, with its permissions and how many members have it.
How access works
The role sets the ceiling. It's a set of permissions, and it caps what someone can do with any item: view, edit or manage.
Open workspaces give a default. A workspace open to the whole organization gives each role a default level, in the table below.
Sharing opens specific items. A grant gives a person or a group view, edit or manage on a workspace, folder or item, and on everything in that folder.
Creators manage what they create, within their role's ceiling.
Owners and Admins see everything. They manage all content, including private workspaces.
Someone's level on an item is the highest of the open-workspace default, being its creator, and every grant that applies, capped by their role. Items you can't see at all read as not found, so a link doesn't tell you they exist.
Roles don't decide which rows someone sees. That's row policies, which apply to every role unless a policy leaves it out.
To give someone a grant, choose Share on a workspace, folder, report, chart or dataset. It lists who has access and why. Someone who manages the item and has Share inside the organization can give members and groups view, edit or manage, and invite someone from outside as an External guest. See Groups and sharing.
Built-in roles
You can't change these.
| Role | What it's for | In open workspaces |
|---|---|---|
| Owner | Full control, including billing, owners and deleting the organization | Manage |
| Admin | Manages people, settings, data and all content. Can't change owners or delete the organization | Manage |
| Builder | Connects data, builds datasets and reports, and publishes them | Edit |
| Analyst | Explores data and builds reports where they're given edit access; publishing needs approval | View |
| Viewer | Reads reports and asks Halo questions | View |
| External guest | Someone outside the organization who sees only what's shared with them | None |
Custom roles
A custom role is a named set of permissions from the catalog below.
In Settings, Roles, press New role.
Give it a Name and an optional Description.
Pick its permissions. You can only include permissions your own role has.
Press Create role.
Then give it to people on the Members page. Changing a role takes effect for its members right away.
A custom role's default in open workspaces follows its content permissions: manage with Manage content and Edit content, edit with Edit content, and view with View content.
To delete one, open it and press Delete role. If members have the role, give them another first.
The permission catalog
Each table shows which built-in roles have a permission.
Organization
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Manage organization settings: change the name, time zone, fiscal calendar, sign-in methods and MFA policy | ✓ | ✓ | ||||
| Delete the organization: close the organization and delete its data | ✓ | |||||
| See the audit log: see who viewed, edited, exported or shared what | ✓ | ✓ | ||||
| See usage and limits: see plan usage and limits | ✓ | ✓ | ||||
| See everyone's jobs: see background jobs started by anyone in the organization | ✓ | ✓ | ||||
| Manage webhooks: choose where Halo sends word of what happens, for any product, and see what was sent | ✓ | ✓ |
People
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| See members: see who belongs to the organization and their roles | ✓ | ✓ | ✓ | ✓ | ||
| Manage members: invite people, change roles, suspend and remove members | ✓ | ✓ | ||||
| Manage owners: make members owners and change owners' roles | ✓ | |||||
| Manage roles: create and edit custom roles | ✓ | ✓ | ||||
| Manage groups: create groups and choose their members | ✓ | ✓ | ||||
| Manage verified domains: verify email domains and set auto-join | ✓ | ✓ |
Content
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Create workspaces: create new workspaces | ✓ | ✓ | ✓ | |||
| View content: open reports and datasets they have access to | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Create content: create folders, reports, charts and datasets where they can edit | ✓ | ✓ | ✓ | ✓ | ||
| Edit content: edit content they have edit access to | ✓ | ✓ | ✓ | ✓ | ||
| Manage content: move, delete and change sharing on content they manage | ✓ | ✓ | ✓ | |||
| Upload images: upload images to the asset library, and add and change map regions | ✓ | ✓ | ✓ | ✓ |
Data
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| See connections: see the organization's connections | ✓ | ✓ | ✓ | ✓ | ||
| Manage connections: add, edit and remove connections and run discovery | ✓ | ✓ | ✓ | |||
| Create datasets: build datasets from connected sources | ✓ | ✓ | ✓ | ✓ | ||
| Write custom SQL: use custom SQL queries and SQL expressions in datasets. Formulas don't need it | ✓ | ✓ | ✓ |
Publishing
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Publish reports: publish report changes directly | ✓ | ✓ | ✓ | |||
| Request publishing: submit report changes for approval | ✓ | ✓ | ✓ | ✓ |
Sharing
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Share inside the organization: share items with members and groups | ✓ | ✓ | ✓ | ✓ | ||
| Share publicly: create public and expiring links | ✓ | ✓ | ✓ | |||
| Embed reports: create embeds for other websites | ✓ | ✓ | ✓ | |||
| Export data: download underlying data as CSV, Excel or JSON | ✓ | ✓ | ✓ | ✓ | ||
| Use the API: make API keys that read through the Developer API what this person can see | ✓ | ✓ | ✓ | ✓ |
AI
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Use Halo AI: ask Halo questions and build with Halo AI | ✓ | ✓ | ✓ | ✓ | ✓ |
Halo CMS
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Open Halo CMS: see the organization's websites and their drafts | ✓ | ✓ | ✓ | ✓ | ||
| Edit websites: change pages, collections and entries, which reach readers only once published | ✓ | ✓ | ✓ | |||
| Publish websites: put a website's draft live, and roll it back | ✓ | ✓ | ✓ | |||
| Manage websites: create and delete websites, and connect their domains | ✓ | ✓ | ✓ | |||
| Read form responses: see and export what readers sent through a website's forms, and read their table in Halo Data | ✓ | ✓ | ✓ |
Halo CRM
Analysts and Viewers can't open Halo CRM unless you say so, because it holds people's contact details.
| Permission | Owner | Admin | Builder | Analyst | Viewer | External guest |
|---|---|---|---|---|---|---|
| Open Halo CRM: see the directory, and the people at businesses, and read the directory's tables in Halo Data | ✓ | ✓ | ✓ | |||
| Edit the directory: change businesses, contacts and listings, take notes, and decide what's in the Inbox | ✓ | ✓ | ✓ | |||
| Manage Halo CRM: change kinds, regions, plans, sources, what feeds websites and Halo Data, and the extranet | ✓ | ✓ | ✓ |
Safeguards
An organization always keeps at least one active Owner. To change the last one, make someone else an Owner first.
Only Owners can make someone an Owner or change an Owner's role.
You can't change your own role or remove yourself from the Members page.
Removing See members hides the Members, Groups, Products and Roles pages, so a Viewer sees only their own account pages in Settings.
A role's permissions apply on the member's next request, including in their AI tools.
Access to one product
A role says what someone does across your organization. Sometimes someone needs something different in one product, such as a communications lead who publishes the website and only reads reports.
Open them under Settings, Members, and choose for each product:
As their role says is where everyone starts.
One of the product's own roles, such as Publisher in Halo CMS, or Viewer, Editor or Manager in Halo CRM. It applies in that product and nowhere else.
No access keeps them out of that product.
Owners and Admins can open every product your organization has, and External guests see only what's shared with them, so this isn't set for them. Someone whose role takes no seat, such as a Viewer, takes one if you give them a role that edits.
A product role covers that product's work. A website that shows numbers from a dataset also makes them public, so publishing it takes Share publicly as well, which Publisher doesn't hold on its own. Someone without it can publish any website with no data sources, and is told why otherwise.
Removing someone takes their product roles with them. If you undo the removal within the hour, they come back too; if you invite them again later, they start from the role you invite them with.
Settings, Products shows what your organization has from Halo. Ask for another product through Contact Halo.