If none of the five built-in roles matches how your team works, build one from individual permissions.
What you can grant
| Group | What is in it |
|---|---|
| Websites | View, add, remove, run a scan, verify ownership |
| Scans | View results, scan history, download reports, ask for an expert review |
| Team | View members, invite, remove, change roles |
| Billing | View billing, manage the subscription |
| Workspace | View settings, change settings, export the workspace |
| Support | View, create and reply to support tickets |
| Service requests | View requests, respond to quotes |
| API | Manage API keys |
Building one
- Open Team, then the roles area.
- Create a role and give it a name your colleagues will understand. "Content editor" tells somebody more than "Custom role 2".
- Tick the permissions it needs.
- Save, then assign it to people exactly as you would a built-in role.
Two traps
Viewing and doing are separate permissions. Somebody who can run a scan but cannot view results will have a strange time. Whenever you grant an action, check the matching view permission is on as well.
Start from nothing and add. Build up from what the person actually needs rather than starting from everything and removing. It is easier to reason about and you will not leave something switched on by accident.
A worked example
A content editor who should fix alternative text and link text but never touch infrastructure, people or money:
- Websites: view
- Scans: view results, scan history, download reports
- Workspace: view settings
- Nothing from Team, Billing, Support or API
That gives them everything needed to work through findings and nothing else.
Editing and deleting
Custom roles can be changed later, and the change applies immediately to everyone holding that role. If you delete a role, move the people using it to another role first.
If it all gets messy
See Resetting roles to their defaults, and read it before you use it.