---
title: "Roles & Permissions"
canonical: https://trickest.com/docs/key-concepts/roles-and-permissions
description: "Understand vault roles, space roles, team inheritance, and the access needed for workflows and data."
---

# Roles & Permissions

## Overview

Permissions combine a **vault role** with access to individual **spaces**. A space is also called a workspace in settings. The rules below describe accounts with role-based access control enabled; feature availability and plan limits apply separately.

Role-based access control is an Enterprise feature. On deployments where it is disabled, these role restrictions do not provide per-space isolation.

## Global Roles

A vault role applies across the organization. Assign it under **Settings > Vault > Members**.

| Role | Scope |
|---|---|
| **Super Admin** | Vault administration and access across all spaces. |
| **Workspace Admin** | Space management and access across all spaces; does not grant every vault-only administrative permission. |
| **Member** | Access comes from direct or team assignments to spaces. |

Both **Super Admin** and **Workspace Admin** have implicit access across spaces. Removing one space assignment does not restrict a user who still holds either administrative vault role. Change the vault role as well when the goal is to limit that user to selected spaces.

Vault-only settings such as member administration remain separate from owning a space. A space Owner is not automatically a Super Admin.

## Workspace Roles

Assign these roles in **Space access** for a user or team. Settings labels them **Write**, **Execute**, and **Read**; API role values use `writer`, `executor`, and `reader`.

| Capability | Owner | Write | Execute | Read | Databases & Apps |
|---|:---:|:---:|:---:|:---:|:---:|
| Manage space access | Yes | No | No | No | No |
| Create and edit workflows | Yes | Yes | No | No | No |
| Execute workflows | Yes | Yes | Yes | No | No |
| View workflow definitions and runs | Yes | Yes | Yes | Yes | No |
| Access databases and apps | Yes | Yes | Yes | Yes | Yes |

**Databases & Apps** is useful for someone who needs the data-facing views without editing or running workflows. It is not a workflow-reader role. Features must still be enabled and available to that account.

A regular Member with no effective role on a space cannot access it. The two administrative vault roles are the exception described above.

## Teams and Permission Inheritance

A team groups users so you can assign space access once. Users can belong to more than one team, and can also have direct space assignments. Effective access combines those grants.

For example, a direct **Read** assignment does not reduce **Write** access inherited through a team. Review both sources when reducing permissions. Removing a user from one team does not remove their direct assignments or access inherited through another team.

## Variables and secrets

Access to workflow data does not mean every stored secret is visible. Personal secrets and space variables have different scopes and reveal behavior. Use [Managing Variables](/docs/using-the-app/workflow-and-executions/managing-variables) for the appropriate workflow and avoid treating a role matrix as permission to expose credentials.

API tokens and connected agents act with the user's access. A connected client does not get a separate, reduced role automatically; choose an appropriately restricted account when needed.

## Next Steps

- [Invite users](/docs/using-the-app/users-access-management/inviting-users).
- [Manage teams and space assignments](/docs/using-the-app/users-access-management/teams-and-roles).
- [Deactivate accounts](/docs/using-the-app/users-access-management/deactivating-users) when access should end.

---
_Markdown source of https://trickest.com/docs/key-concepts/roles-and-permissions._