How Halo is organized

Organizations hold workspaces, workspaces hold folders, and folders hold your assets. Access is set by your role and opened up by sharing, which inherits down folders.

Everything in Halo has a place, and that place helps decide who can see it. There are four levels:

Organizations

Halo's team sets up your organization, and you run it from there. Nothing in one organization is visible to another, and Halo enforces that in the database, on every query.

A person can belong to several organizations, with a different role in each. The switcher at the top of the sidebar moves between them.

Workspaces

A workspace holds reports, charts, datasets and connections. Owners, Admins and Builders can create one from the Workspaces page. Who can find it decides how open it is:

• The organization: everyone in the organization, within their role.

• People it's shared with: only them, and anyone a folder in it is shared with.

An organization always keeps at least one workspace. Deleting a workspace moves it and everything in it to the Trash, and restoring it brings back exactly what went with it.

Folders

Folders group what's in a workspace, and the sidebar shows them as a tree. They matter for access as well as tidiness, because sharing a folder shares what's in it. Deleting a folder takes its subfolders and contents to the Trash together, so nothing shared only through that folder opens up to the rest of the workspace.

Assets

Assets are what you build with, and each has a home:

• Connections, datasets, charts and reports sit in a workspace. Who can use a connection follows its workspace's sharing.

• Templates start new reports, and are listed from the Reports page. See Templates.

• Images live in the organization's asset library, with folders and tags of their own.

How access is worked out

Two things decide what you can do with an item: your role, and your access to the item.

Your role sets the ceiling. It's a set of permissions, and it also limits the most you can do with any item: view, edit or manage. A Viewer with a manage grant still only views.

Your access to the item comes from the highest of these:

1. The open-workspace default. In a workspace open to the organization, each role starts at a level.

   Role	Default level
   Owner, Admin	Manage
   Builder	Edit
   Analyst, Viewer	View
   External guest	None

2. Being its creator. You manage what you create, within your role's ceiling.

3. Any grant that applies. A grant gives a person or a group view, edit or manage on a workspace, folder or item.

Owners and Admins manage all content, including private workspaces. An item you can't see at all answers as not found, rather than saying it exists and refusing you.

Roles and permissions has the full table.

Sharing inherits down folders

A grant covers everything inside what it's on. Say your Marketing workspace looks like this:

Marketing
└── Campaigns            Sales group: view
    ├── 2026             Priya: edit
    │   └── Q3 revenue   (a report)
    └── Channel mix      (a report)

• The Sales group can view both reports, because they're inside Campaigns.

• Priya can edit Q3 revenue, because it's inside 2026, and can view Channel mix if she's in the Sales group. If her role is Viewer, she still only views either one.

• If the workspace is set to People it's shared with, nobody else sees them, apart from Owners and Admins.

Grants only add access. To take it away, remove the grant that gave it.

Sharing outside your organization

Public links and embeds are separate from all of this. They show the published version of one report to people who aren't members, and they're set on the report itself. See the Sharing overview.