Custom Roles & Permissions
Built-in roles (Owner, Creator, Editor, Commenter, Viewer) cover most teams, but sometimes you need something in between -- for example, an editor who can change records but must not delete fields, or a role that cannot use the AI chat assistant. Custom roles let a base admin define exactly what a group of collaborators can do, one action at a time.
Custom roles live per base. Only a base Owner or an admin (anyone with the Edit table settings permission) can see and manage them. The server enforces every rule regardless of what the interface shows, so a custom role can never be used to escalate beyond what the admin granted.
Where to Find It
- Open the base and click Manage collaborators (the members / share button).
- Scroll to the Custom roles section at the bottom of the dialog. It only appears if you have permission to manage the base.
From here you can create roles, edit their permissions, reorder them, and assign collaborators.
Creating a Role
- Click New role.
- Give it a Name (e.g. "Team Lead", "Read-only Analyst").
- Set a Rank. Rank is a number that expresses seniority -- a higher number means a more senior role. Rank matters for the Own + same/lower role scope explained below. If you are unsure, leave the default and adjust later.
- Set the permissions using the matrix (see next section).
- Click Save.
New roles appear in the list, most senior (highest rank) first. Use the up/down arrows to swap a role's rank with its neighbour.
The Permission Matrix
Each row is a single action the role can perform, grouped by area:
- Records -- create, view, edit, delete, comment
- Fields -- create, view, edit, delete
- Views -- create, view, manage, delete
- Table settings -- view, edit
- Import / Export -- import records, export records
- Automations -- create, view, run, delete
- AI -- Use AI chat
For every action you pick an access scope from a dropdown. There are four scopes, from most restrictive to most permissive:
| Scope | What it means |
|---|---|
| No access | The action is fully blocked for this role. |
| Only own | Only items the collaborator created themselves. |
| Own + same/lower role | Items they created, plus items created by collaborators of an equal or lower rank -- but not items created by someone in a higher-ranked role. |
| All (incl. higher roles) | Every item, with no ownership restriction. |
Not every action offers all four scopes. Actions that have no concept of an "owner" -- create, view/read, import, export, and Use AI chat -- are a simple allow (All) or deny (No access). Ownership scopes (Only own, Own + same/lower role) apply to the per-item actions: editing and deleting records, fields and views, commenting, editing table settings, and editing or deleting automations.
Saving the role replaces its entire permission set with what the matrix currently shows, so the matrix always reflects the role's exact permissions.
The AI Chat toggle
The Use AI chat row (under the AI section) controls whether members of this role can use the in-base AI chat assistant. Set it to All to allow it, or No access to switch AI chat off for everyone in the role. This is the only base-level toggle in the matrix and it is a straightforward allow/deny -- there is no ownership scope for it.
Assigning Collaborators
Scroll to Assign roles in the same dialog. Each collaborator has a dropdown showing their current role:
- Pick a custom role to assign it. The collaborator immediately takes on that role's permissions.
- Pick No custom role to remove the assignment. The collaborator falls back to their built-in base role (Editor, Viewer, etc.) -- they are never left without a role.
A collaborator has exactly one effective role at a time: either a custom role you assigned, or their built-in role.
Tips
- Start from a built-in role in your head. Decide which standard role is closest, then tighten or loosen individual actions from there.
- Rank deliberately. If you want a "Senior editor" whose records a "Junior editor" cannot touch, give the senior role a higher rank and give the junior role Own + same/lower role on record edit/delete.
- Read is separate from edit. Granting Edit records does nothing useful without View records. Make sure view/read is allowed for anything the role should work with.
- Turn off AI chat per role, not per person. If a group should not use AI, put them in a role with Use AI chat set to No access rather than managing it one user at a time.
- Owners are never restricted. A custom role can only grant access relative to safety limits; it can never lock a base Owner out.
Troubleshooting
- "Can't delete a role that still has members." A role cannot be deleted while collaborators are still assigned to it. Go to Assign roles, move each affected collaborator to another role (or back to No custom role), then delete the role.
- A collaborator still can't do something after I granted it. Check that the enabling read/view action is also granted, and that the action's scope is not left on Only own when they need to act on others' items. Remember the server enforces the strictest of the built-in and custom rules.
- The AI chat assistant is missing for someone. Confirm their role's Use AI chat is set to All. If it is No access, AI chat is intentionally disabled for that role.
- I don't see the Custom roles section. You need base-admin permission (Edit table settings) to manage roles. Ask the base Owner to grant it or to make the change for you.
- My permission change didn't take effect immediately. Reload the base. Role and permission changes apply on the next request; a refresh guarantees the latest rules are in force.