Workspace Roles and Permissions: Complete Access Control Guide

Agrello uses a two-layer permission system. Workspace roles control workspace-wide capabilities. Folder permissions control document access. Understanding both layers helps you secure sensitive contracts while enabling team collaboration.

Two-Layer Permission System

Layer 1: Workspace Roles determine what someone can do across the entire workspace—manage billing, invite members, access all folders.

Layer 2: Folder Permissions determine what someone can do in specific folders—create documents, send for signing, or just view.

These layers combine. A Member (workspace role) with Editor permission (folder role) on the HR folder can create employment contracts. The same Member without access to the Finance folder cannot see financial agreements.

This separation enables precise access control. HR sees HR documents. Finance sees financial documents. Executives see everything.

Workspace Roles

Three workspace-level roles control workspace management and visibility.

Owner

Full control. Owners manage everything.

Capabilities: - Manage subscription and billing - Configure workspace settings (name, logo, branding) - Invite and remove members - Change member roles - View and manage all folders automatically - Create and manage templates - Create and send documents - Access usage statistics

Who should be Owner: Business owner, IT administrator, or finance contact. Someone responsible for billing and workspace-wide decisions.

One per workspace typically: Multiple Owners possible but uncommon. Clear ownership prevents conflicts.

Transfer ownership: Owners can transfer ownership to another member. New owner gains billing access. Previous owner becomes Administrator or Member.

Administrator

Manages team workflows without billing access.

Capabilities: - View all folders automatically - Add members to folders - Grant Editor or Viewer permissions - Create and share templates - Full document lifecycle control - View folder analytics

Cannot: - Manage subscription or billing - Transfer workspace ownership - Delete workspace

Who should be Administrator: Department heads, team leads, office managers. People who coordinate workflows across multiple teams.

Cross-functional visibility: Administrators see all folders—helpful for managing contracts across departments.

Member

Works in assigned folders only.

Capabilities: - Access folders they're invited to - Create and manage documents in accessible folders - Use shared templates - Comment and collaborate

Cannot: - View folders they're not invited to - Add members to folders - Manage workspace settings - Access billing - See all workspace templates (only those in their folders)

Who should be Member: Individual contributors, specialists, external collaborators. Anyone needing specific folder access without workspace-wide visibility.

Default role: Most team members should be Members with Editor permissions on relevant folders.

Folder Permissions

After granting workspace access, you set folder-specific permissions.

Editor

Creates and manages documents.

Capabilities: - Create documents (upload files, use templates, built-in editor) - Create templates from documents - Send for signing (prepare, add signers, send invitations) - Manage documents (edit drafts, void, delete) - Download files (originals and signed copies) - Export CSV data from templates - Add comments - View all folder documents

Who gets Editor: Team members who actively create and send contracts. HR coordinators creating employment agreements. Sales reps sending customer contracts.

Viewer

Monitors without creating.

Capabilities: - View all documents in folder - Add comments for feedback - Track signing progress - Download documents (if permitted)

Cannot: - Create documents - Create templates - Send for signing - Edit documents - Delete documents - Export CSV data

Who gets Viewer: Stakeholders needing visibility. Executives monitoring contract activity. Auditors reviewing compliance. Legal reviewing contracts before approval. External clients viewing draft agreements.

Valuable for approval workflows: Legal team gets Viewer access. Reviews drafts. Adds approval comments. Creator sends after approval.

Setting Folder Permissions

Navigate to folder. Open the folder where you want to grant access.

Click Permissions tab. Find permissions section in folder settings.

Add access: Click "Add access permissions" or similar button.

Select member: Choose team member from workspace list.

Choose role: Editor or Viewer.

Save changes: Permission takes effect immediately.

Member access: Member now sees folder in their interface. Can perform actions according to permission level.

Permission Combinations

Workspace role + folder permission = actual capabilities.

Owner + Editor on HR folder: - Full workspace control - Full HR document management - Can invite others to HR folder

Administrator + Viewer on Finance folder: - Can see all workspace folders (Administrator privilege) - Can only view Finance documents, not create (Viewer restriction) - Can grant Finance access to others (Administrator privilege)

Member + Editor on Sales folder: - Cannot see other folders - Full document control in Sales folder - Cannot invite others to Sales folder (needs Administrator or Owner)

Member + Viewer on Legal folder: - Cannot see other folders - Can view and comment on Legal documents - Cannot create or send documents

Best Practices

Default to Member role: Most users should be Members. Reserve Administrator for actual coordinators managing across departments.

Grant minimum permissions: Give Viewer access when monitoring is enough. Upgrade to Editor when document creation is needed.

Organize by function: Create folders by department or function. Grant relevant team members access to their folders only.

Use Viewer for approval: Legal, compliance, executives—grant Viewer access. They review and approve via comments before documents send.

Administrators for coordinators: Grant Administrator only to people truly managing cross-functional workflows. Don't grant just for convenience.

Regular permission audits: Quarterly review who has access to what. Remove access for former employees or people who changed roles.

Document your structure: Maintain a spreadsheet showing which roles have which folder access. Helps onboard new team members and prevents confusion.

Security Considerations

Sensitive folders: Financial contracts, executive agreements, confidential partnerships—restrict to specific Members with Editor access. Don't grant broad access.

External collaborators: Contractors, consultants, clients—invite as Members with Viewer access to specific project folders. Remove access when engagement ends.

Billing protection: Only Owners see billing. Prevents unauthorized subscription changes or exposing cost information.

Template control: Members only see templates in folders they access. Prevents unauthorized template modification across organization.

Audit trails: All permission changes record in audit logs. Track who granted access to whom and when.

Common Scenarios

New employee onboarding: 1. Invite as Member 2. Grant Editor access to their department folder 3. Grant Viewer access to relevant cross-departmental folders

Department head setup: 1. Assign Administrator role 2. Automatically sees all folders 3. Can grant permissions to team members

Executive visibility: 1. Assign Member role (unless they manage billing) 2. Grant Viewer access to all relevant folders 3. They monitor without creating documents

External legal reviewer: 1. Invite as Member 2. Grant Viewer access to specific contract folder 3. They review and approve via comments 4. Remove access after review completes

Contractor engagement: 1. Invite as Member 2. Grant Editor access to project folder only 3. They create and manage project documents 4. Remove access when project ends

Troubleshooting Access Issues

Member can't see folder: Check if they have folder permission granted. Workspace membership alone doesn't grant folder access.

Member can't send documents: Verify they have Editor permission. Viewers cannot send.

Can't export CSV: Only Editors can export. Viewers don't have this capability.

Member sees too many folders: If they're Administrator, they see all folders automatically. Change to Member role if inappropriate.

Can't add someone to folder: Only Administrators and Owners can grant folder access. Members cannot invite others.

Changes don't appear: Permissions update immediately. If member doesn't see change, have them refresh browser or log out and back in.

Permission Matrix

Quick reference for role capabilities:

Workspace Management: - Billing: Owner only - Invite members: Owner, Administrator - Change roles: Owner, Administrator - View all folders: Owner, Administrator

Folder Access: - Create documents: Editor - Send for signing: Editor - Export CSV: Editor - Create templates: Editor - View documents: Editor, Viewer - Add comments: Editor, Viewer

Key principle: Viewers monitor. Editors act. Administrators coordinate. Owners control.