Permission levels by app
Every app you can give access to, its levels, and what each level allows.
When you edit a role, each app has a dropdown of levels. Levels build up: each one includes everything in the levels above it in the list. This page lists all of them, in the order the role editor shows them.
Most apps start at No access, which means the person cannot open the app. The editor shows 24 apps in eight groups, plus two public-access apps that appear only on a role for visitors who are not signed in.
Note: Records, files and a few other apps can also be limited to one record type, one shared space, one form or one queue. The level dropdown always grants the app everywhere. For anything narrower, use Advanced rules. See Create and edit roles.
Levels
Operations
| App | Level | What it allows |
|---|---|---|
| Business records | No access | Cannot open this app. |
| Can view | Read records and their fields. No changes. | |
| Can add & edit | Create and update records, import and export spreadsheets. | |
| Full control | Everything above, plus deleting records and changing what fields exist. | |
| Work queues | No access | Cannot open this app. |
| Can view | See the board and where every item stands. | |
| Can work the queue | Scan items in and move them along stages. | |
| Full control | Everything above, plus creating and changing the queues themselves. | |
| Sheets | No access | Cannot open this app. |
| Can view | Open workbooks read-only. | |
| Can edit | Change cells, rows and tabs. | |
| Full control | Everything above, plus creating, renaming and deleting workbooks. | |
| Files | No access | Cannot open this app. |
| Can view | Browse and download files. | |
| Can edit | Upload, move and delete files. | |
| Full control | Everything above, plus creating shared spaces and managing who they are shared with. | |
| Calendars | No access | Cannot open this app. |
| Can view | See organization calendars and their events. | |
| Can edit | Add, move and cancel events on organization calendars. | |
| Full control | Everything above, plus creating calendars, booking pages and subscription links. | |
| Document templates | No access | Cannot open this app. |
| Can view | See templates and past documents. | |
| Can generate | Produce PDFs from a record. | |
| Full control | Everything above, plus writing and editing the templates. |
Commerce
| App | Level | What it allows |
|---|---|---|
| In-store checkout | No access | Cannot open this app. |
| Can view | See registers and the sales they rang up. | |
| Can sell | Ring up sales and void a sale that has not been paid. | |
| Full control | Everything above, plus refunds and register setup. | |
| Online stores | No access | Cannot open this app. |
| Can see connections | Know a store is connected, without reading its data. | |
| Can browse the store | Read live products, orders and customers from the shop. | |
| Full control | Everything above, plus connecting and disconnecting shops. |
Marketing
| App | Level | What it allows |
|---|---|---|
| Ad campaigns | No access | Cannot open this app. |
| Can view | Read spend and performance. | |
| Can run campaigns | Pause, resume and change budgets — this spends money. | |
| Full control | Everything above, plus connecting and disconnecting ad accounts. | |
| Website content | No access | Cannot open this app. |
| Can view | Read pages, including unpublished drafts. | |
| Can write drafts | Write and edit, but not put anything live. | |
| Can publish | Put pages live and take them down again. | |
| Full control | Everything above, plus creating and deleting content spaces. |
Communications
| App | Level | What it allows |
|---|---|---|
| Messaging | No access | Cannot open this app. |
| Can view | Read templates and the delivery log. | |
| Can send | Message one customer at a time. | |
| Full control | Everything above, plus bulk sends, templates and provider accounts. |
Money
| App | Level | What it allows |
|---|---|---|
| Accounting ledger | No access | Cannot open this app. |
| Can view | Read the journal and balances. | |
| Can post entries | Post journal entries and reversals. Posted entries can never be edited. | |
| Collecting payments | No access | Cannot open this app. |
| Can view | See payment links and what was paid. | |
| Can collect | Create and cancel payment links. | |
| Full control | Everything above, plus the provider accounts and their keys. | |
| Plan & invoices from AxisIQ | No access | Cannot open this app. |
| Can view | See the plan, usage and statements. | |
| Can change the plan | Subscribe, upgrade, downgrade and cancel. |
Intelligence
| App | Level | What it allows |
|---|---|---|
| Analytics & reports | No access | Cannot open this app. |
| Can query & read | Run queries and open reports. Only data they may already read is visible. | |
| Full control | Everything above, plus saving reports and dashboards for everyone. | |
| Ask Axis assistant | No access | Cannot open this app. |
| Can use | Chat with the assistant. | |
| Use & see AI spend | Chat, and see what the workspace is spending on AI. | |
| Full control | Also manage the shared connectors (outside tools) the assistant can use. | |
| Knowledge base | No access | Cannot open this app. |
| Can search | Search the knowledge base and get answers from it. | |
| Can add documents | Upload documents and choose which records get indexed. | |
| Full control | Everything above, plus creating and deleting collections. |
Automation
| App | Level | What it allows |
|---|---|---|
| Automations | No access | Cannot open this app. |
| Can view | See flows and their run history. | |
| Can run | Trigger a flow by hand. | |
| Full control | Build and delete flows. A flow acts with its author's permissions, so this is a trusted job. | |
| Custom code | No access | Cannot open this app. |
| Can view | Read the code. | |
| Can run | Invoke a function. It acts with the caller's permissions. | |
| Full control | Write and change functions. Code is unbounded — a trusted job. | |
| Forms | No access | Cannot open this app. |
| Can view | Open a form. | |
| Can fill in | Open and submit a form, without seeing anyone else's answers. | |
| Can read answers | Everything above, plus the submission log. | |
| Full control | Build, publish and delete forms. |
Platform
| App | Level | What it allows |
|---|---|---|
| Notifications | No access | Cannot open this app. |
| Can view | See the notification rules. | |
| Full control | Create and delete notification rules. | |
| People & permissions | No access | Cannot open this app. |
| Can invite people | Send invitations. Cannot change permissions. | |
| Can manage people | Invite, remove, and move people between roles. | |
| Full control | Everything above, plus creating roles and editing what they allow. | |
| Organization settings | No access | Cannot open this app. |
| Can change settings | Rename the workspace, set its currency. | |
| Audit trail | No access | Cannot open this app. |
| Can view | Read the change history. |
Public access
| App | Level | What it allows |
|---|---|---|
| Published pages | No access | Cannot open this app. |
| Readable by anyone | Published pages, images and sitemaps are served to the public internet. | |
| Public forms | No access | Cannot open this app. |
| Open to anyone | Anyone with the link can fill the form in. They can never read the answers. |
Reading the table
- Full control usually adds creating, deleting and connecting things on top of the earlier levels. The exact words are in the third column.
- Some apps have no Full control level. Accounting ledger stops at Can post entries and Audit trail only has Can view.
- The Automations and Custom code apps carry a warning on their top level. A flow acts with the permissions of whoever last edited it, and code can do anything its author can. Treat these as trusted jobs.
- Ad campaigns at Can run campaigns can pause campaigns and change budgets, which spends money.
- If a role carries a rule the dropdown cannot express, such as a deny or a rule limited to one type, the app row shows a Custom rules badge and the dropdown still shows only the part it understands.