What each person can open: service access
No access, Viewer, Editor and Admin in each service, the extra permissions, the CDP editor preset, and how a member asks for more access.
The workspace role says what someone can do in the workspace. Service access says what a Member can do in each service: CDP, Push, Automation, CRM, Pages, Assistant and Agents.
Who needs service access
- Owners and admins have full access to every service. Nothing to set: the per-service settings are ignored for them.
- Members open only the services you give them. A service they have no access to is not on their dashboard or in their menu, and its link does not let them in.
- Guests never get access to a whole service — only to the records shared with them. See Invitations: send, resend, accept.
Give or change access
You choose service access when you invite someone. To change it later:
- Open Members → Active members and click Manage next to the person. The window Member access opens with their name and e-mail.
- Under Service access, choose a role for each service: No access, Viewer, Editor or Admin.
- Tick or untick the extra permissions that appear under a service.
- Click Save changes. Cancel drops what you have not saved.
No access applies at once, even in a service the person has open. A new role applies the next time they open the service from the Hub. Their menu in the Hub can take up to two minutes to change.
The four service roles
| Role | In short |
|---|---|
| No access | The service is hidden from them and closed to them. |
| Viewer | Looks, changes nothing — with the exceptions in the next table. |
| Editor | Does the everyday work in the service. |
| Admin | Everything in the service, including its settings. |
What the roles mean in each service
Every service applies the three roles in its own way.
| Service | Viewer | Editor | Admin |
|---|---|---|---|
| CDP | Sees every dashboard and report; cannot change anything. | Works with segments, funnels and the rest of the data. | Also API keys, integrations and webhooks. |
| Push | Sees every screen; cannot change or send anything. | Creates and changes campaigns, templates, lists and subscribers; sends and schedules only with Can send campaigns. | Also creates and revokes API keys, deletes an app and deletes a sending domain. |
| Automation | Sees flows and their runs, with customers' personal data hidden; cannot create, change, publish or run a flow. | Creates, changes, publishes and runs flows. | Everything in Automation. |
| CRM | Sees their own records, those shared with them and those with no owner, and changes none of them; keeps their own activities, calendar and tasks. | A salesperson: creates contacts, companies, leads, deals and invoices, and changes those they own or that have no owner. A record shared with them is view only. | A manager: sees and changes every record in the workspace, deletes, and the CRM settings: Who sees which records. |
| Pages | Reads pages. | Writes and edits pages. | Everything in Pages. |
| Assistant | Shown as Наблюдател (Observer): sees, does not answer. | Shown as Агент (Agent): answers conversations in the inbox and approves actions. Cannot set up bots. | Shown as Администратор: also bots, flows, channels and settings. |
| Agents | Sees agents and their reports; cannot change them. | Creates and changes agents. | Everything in Agents. |
Extra permissions
Some services have a permission on top of the role. It appears under the service once you give it a role.
| Permission | Service | What it allows |
|---|---|---|
| Can send campaigns | Push | Sending and scheduling campaigns, and sending transactional messages, also through the Push API. On by default for Editor and Admin. Untick it to let someone prepare campaigns that another person sends. |
| Can run GDPR export | CDP | Exporting all the data of one person — the right of access and portability. Owners and admins can always do it; for others it is off unless you tick it. |
Limit CDP to some sections
For a CDP Viewer or Editor you can tick Only these CDP sections and choose from News, Newsroom Intelligence, Brands and Funnels. The person then sees only those sections and nothing else in CDP. Choose at least one section, or the form says Pick at least one CDP section, or untick "Only these CDP sections". Admins are never limited.
Preset: CDP editor (view only) sets it all in one click: role Member, CDP Viewer with all four sections, no GDPR export, no other service. It is made for editors of news websites.
See who has what
- Members → My access — your own role in this workspace and your access to each service. Owners and admins see You bypass per-service role checks in this workspace.
- Members → Permissions matrix — your roles in every workspace you belong to, service by service. ADMIN* means the role comes from being an owner or admin.
- The Manage window of each member — their role and access in this workspace.
Ask for more access
A member who needs more:
- Opens Members → My workspaces and clicks Request access next to the workspace.
- In Request more access, chooses a Workspace role upgrade (optional) and the services and roles they need, under Service grants (toggle to request).
- Writes why in Why do you need this? — up to 1000 characters — and clicks Send request.
The owners and admins get an e-mail: Access request from the person's name. They decide in Members → Access requests:
- Approve applies the change at once. You can add a reason the requester will see.
- Deny asks for a reason, which the requester sees.
The requester gets an e-mail with the decision. A request nobody decides within 14 days expires. Only one request at a time: to change it, the requester clicks Cancel next to it and sends a new one.
If something doesn't work
A member does not see a service
They have No access to it, or the service is not active in the workspace. Check Manage next to them; to activate a service, see Open, activate and deactivate services.
The service says they have no access
The role was given after they opened the service. Ask them to go back to the Hub and open the service again.
Someone cannot change or send anything in Push
Push tells them why:
- You have view-only access to Push in this workspace. — their Push role is Viewer. Give them Editor.
- Sending and scheduling need the "Can send campaigns" permission. — they are an Editor without the permission. Tick Can send campaigns.
- Only an admin of Push can do this. — API keys and deleting an app or a sending domain are for a Push Admin.
Exporting personal data needs a workspace admin
The CDP message for a member without Can run GDPR export. Tick it for them, or ask an owner or admin to export.
You already have a pending access request for this workspace
Cancel the open request in Members → Access requests, then send a new one.
This is the primary owner of the workspace. Nobody can change their role or remove them.
The primary owner — the person who created the workspace — always stays an owner. To hand the workspace to another member, the primary owner writes to [email protected]. See The primary owner.