Note: The New System permissions are gradually rolled out during H2 of 2026

Overview

This article is the complete reference for Datarails' permissions model. It covers the five system roles, how element-level access works, detailed capability tables by role, permissions for each product module, and how group permissions behave.

Two ideas underpin everything below: data access is managed at the table level, and element permissions govern what you can do with an element. Sharing a dashboard, report, or Filebox controls what a user can open and act on. What data they see inside it is controlled separately, by their access to the tables behind it.

This article replaces User Management in Datarails and Managing Data & User Access Rights.

System Roles

Datarails has five system roles. Each role is designed for a specific type of user and defines the ceiling of what they can do across the product.

Permission Levels

When an element is shared with a user, it can be granted at one of up to three access levels:

How Permissions Work

• Role sets the ceiling — element access grants the permission. A user's system role determines the maximum element-level access they can be granted; a Viewer cannot be made Owner or Editor of any element. But the role on its own grants nothing: each table, Filebox, dashboard, and report must also be shared with them individually. Both have to be satisfied before an action succeeds.

• Highest access wins. When a user has both individual and group permissions on the same element, the higher access level applies — in both directions.

• Super Admins are auto-shared. Super Admins have implicit access to all elements in the organization and cannot be removed from any element.

💡 Tip: Open a user's Profile screen (Members & Groups → click any user) to see every element they have access to and at what level — a fast way to audit access before onboarding or offboarding a team member.
 

Functional Capabilities by Role — Core Actions

The table below shows which actions each system role can perform across the product. A ✓ means the role is allowed to perform the action — it does not grant access to any particular table, Filebox, dashboard, or report. The Comment column says what else has to be true.

What each access level means per element:
 

The rule to remember: tables control data. Elements control functionality. Access to a dashboard, report space, Filebox, or workflow determines what you can do with it. Access to a table determines what data you can see — everywhere it appears, in every report, dashboard, Excel function, KPI and AI Agent. Granting one never grants the other.

Data Tables (Data access)

Read more on Data Access Management in Datarails.

• Viewer: View table data only, A permission filter can only be applied to a Viewer.

• Owner: Sees all data mapped to the table - permission filters can't be applied, create, modify, and delete tables; manage table permissions; grant access to others

Data-sources

• Sync: Trigger syncs on connected Fileboxes (requires Editor or Owner access on those Fileboxes)

• Owner: Edit integration settings, manage sync schedules, share the Data-source with others

Fileboxes, Folders & Collections

• Viewer: View documents and data only

• Editor: Upload and manage document versions; view and edit content

• Owner: Approve workflows, assign versions, edit metadata, manage collaboration, delete, lock, upload, and view/edit content

Report Spaces

• Viewer: View reports only

• Editor: Manage and view reports

• Owner: Manage and rename reports; full control over the report space

Workflows

• Editor: Edit the workflow, clone instances, assign members, lock tasks and mark them complete

• Owner: Create, configure, activate/deactivate, archive, delete, and share workflows; manage members

Dashboards

• Viewer: View dashboards only

• Editor: Modify filters and widgets; view dashboards

• Owner: Modify dashboards, filters, and widgets; share and manage access

Storyboards

• Viewer: View stories

• Editor: Add and change stories

• Owner: Add, change, delete, and share stories

Product Permissions (Coming Soon)

Each Datarails product module has its own permission model. Access to a product module must be explicitly shared with a user — with the exception of Super Admins, who have access to all modules by default. Granting access to each requires access to its dedicated tables — when sharing the product the system will prompt you to grant table access as well.

Month End Close (MEC)

MEC has three access levels:

• Viewer: View the Summary and Reconciliation screens. Data visibility is determined by the user's access to the Trial Balance (TB) table.

• Editor: All Viewer capabilities, plus: participate in shared workflows and tasks, perform reconciliation actions.

• Owner: All Editor capabilities, plus: access MEC Settings and full reconciliation management.

Only Admin and Super Admin can be assigned as MEC Owner.

Cash

Cash has two access levels:

• Viewer: View all Cash pages (transactions and balances). Data visibility is determined by the user's access to the Bank_Transactions and Bank_Balances tables.

• Owner: All Viewer capabilities, plus: manage rules, edit transaction categories, and share the Cash module with others.

Group Permissions

Groups allow you to share elements with multiple users at once. Permissions assigned to a group follow the same role-based rules as individual permissions.

How group permissions work

• Highest access wins. If a user has both individual and group permissions on the same element, the higher access level applies — in both directions.

• Groups cannot lower individual permissions. If a user already holds Owner access individually, adding them to a group with Viewer access will not downgrade their access.

• Lower-role members are flagged. If a group contains members whose system role prevents them from receiving the assigned access level, the system displays a modal alert listing the affected users and asking how to proceed. Continuing caps the group at the level its least privileged member can hold.

Role changes and group membership: 

• Adding a lower-role member to a group. A group's access level on the elements it is shared on is capped by its least privileged member. If you add someone whose system role cannot hold the group's current level, Datarails warns you first, and the group's level drops for everyone whose access came only from that group. Members who also hold the access directly are unaffected.

• Changing an existing member's role. When a member's system role is lowered — from Admin to Viewer, for example — only that member's effective access is adjusted down to their new ceiling. The group's access level on shared elements is not affected, other members are unaffected, and the member stays in the group.

• Your effective access is the highest of the two. Where you hold access both directly and through a group, the higher level applies. A direct Owner grant is not reduced by membership of a Viewer group.

How group permissions are displayed

• A user shared via a group will show an ℹ icon next to their access level, indicating the permission comes from a group rather than a direct individual share.

• If a user belongs to multiple groups with different access levels on the same element, the highest level applies.

• Hovering over a group name shows a pop-up listing all members in that group.

What Changed from the Previous Model

• Roles: The previous model had three roles — Admin, Contributor, and Viewer. This has expanded to five to provide more precise control. Contributor was split into Manager (power users who build, map, and manage content) and Collaborator (users who upload and submit data), ensuring no one has more system-level access than their role requires. Admin was split into Super Admin (auto-shared on all elements) and Admin to enable data segregation between different parts of the business.
   

• Filebox permissions for linked Fileboxes: When a Filebox is mapped to a data table, the actions available to a user are now determined by the combination of their table access level and their Filebox access level. Users who have direct Filebox access but no access to the linked table can still upload and view content, but cannot perform actions such as deleting or archiving the Filebox, or creating and editing its data mappers.

Updated September 09, 2026 23:00