Read the access matrix

Screen /access-matrix · Roles: Owner, Admin (a member:manage seat)

“What can a coordinator actually see?” used to be a question you had to ask us. The access matrix answers it in the product.

It shows, for your workspace:

• every role and the capabilities it holds;
• every page that is gated, and what gates it;
• every endpoint a capability unlocks.

It is linked from the header of the Team page, and it is read-only.

It is generated from the same registry the product enforces

The matrix is not a hand-written table that can drift from behaviour. It is generated from the definitions the application checks at request time, so if the matrix says a role cannot open a page, that role cannot open that page.

Reading it before you invite somebody

The useful order is:

1. Find the job you are hiring for in the role list.
2. Read what it grants, not what its name suggests.
3. If it grants more than you want, look at custom roles - which have a hard ceiling: no custom role can move money or release a door code.
4. Scope the seat to the properties it covers - see Limit a seat to properties.

A seat and its operational roles are separate grants

The seat someone holds and the operational roles they carry are independent. Removing one does not remove the other, and a role carried by a team counts exactly as much as a role held directly - so a person can reach a capability by two routes. The matrix shows the capability; the Team screen shows which routes reach it.

What’s next

• Choose the right role.
• Custom roles.
• The roles matrix reference.