This article is the reference for the Datarails permissions model. It explains the five system roles, the access levels you can give on each element, what each role can do, and how group permissions behave and replaces User Management in Datarails and Managing Data & User Access Rights.
New permissions model: The new permissions model is rolling out gradually during the second half of 2026. If your screens look different, your organization may not have it yet.
What changed from the previous model
- Five roles instead of three. The previous model had Admin, Contributor and Viewer. Contributor is now two roles: Manager, for people who build, map and manage content, and Collaborator, for people who upload and submit data. Admin is now two roles: Super Admin, who has access to everything, and Admin, who sees only what they create or are shared on. This lets you keep data separate between parts of the business.
- Data access moved from Fileboxes to tables. What data a person sees is now set by their table access, not by which Fileboxes are shared with them. For Fileboxes mapped to a table, some actions now need access to both.
How permissions work
Four rules explain everything else in this article:
- Tables control data. Elements control what you can do. Sharing a dashboard, report space, Filebox or workflow lets someone open it and act on it. What data they see inside it depends on their access to the tables behind it. Granting one never grants the other.
- The role sets the limit. Sharing grants the access. A person's system role decides the highest access level they can be given. For example, a Viewer can't be made an Editor or Owner of anything. The role alone grants nothing: each table, Filebox, dashboard and report must still be shared with them, directly or through a group.
- The highest access wins. When someone has access to the same element both directly and through a group, or through several groups, the highest level applies.
- Super Admins have access to everything. A Super Admin is automatically an Owner of every element in the organization and can't be removed from any of them.
Tip: To see everything a person can access and at what level, go to Admin > Members & groups and click their name. This is a quick way to check access before onboarding or offboarding someone.
System roles
Every member has one system role.
| Role | Best for | What they can do |
|---|---|---|
| Viewer | Executives and other read-only stakeholders | View and download the elements shared with them. Can't create or manage anything. |
| Collaborator | Budget submitters and department contributors | Upload data, submit inputs, and view and edit the Fileboxes and report spaces shared with them. Can't create tables or manage organization settings. |
| Manager | FP&A analysts and data owners | Create and manage tables, dashboards, reports and storyboards. Map data and manage integrations. Manage permissions on the elements they own. |
| Admin | Finance leads, department heads and the accounting team | Manage members, organization settings and integrations. Has full access to the elements they create or are shared on, but isn't automatically shared on everything. |
| Super Admin | IT administrators and system owners | Full access to all elements, settings, members and data in the organization. |
Choosing between Collaborator and Manager: If someone needs to upload data but doesn't build dashboards or create tables, make them a Collaborator. Keep Manager for people who build and manage content.
Access levels
When you share an element, you choose an access level. Each level includes everything the level below it allows.
| Access level | What it allows |
|---|---|
| Viewer | View and download only. |
| Editor | Change and manage the content, but not delete or share the element. |
| Owner | Full control: edit, delete, share and manage the element. |
The levels a person can be given depend on their system role:
| System role | Viewer | Editor | Owner |
|---|---|---|---|
| Viewer | Yes | No | No |
| Collaborator | Yes | Yes | No |
| Manager | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes |
| Super Admin | Not applicable | Not applicable | Always |
Not every element has all three levels. For example, tables have only Viewer and Owner. See What each access level allows, by element.
What each role can do
The table shows which actions each role is allowed to perform. "Yes" means the role allows the action. It doesn't give access to any particular table, Filebox, dashboard or report. The last column says what else is needed.
| Action | Viewer | Collaborator | Manager | Admin | Super Admin | What else is needed |
|---|---|---|---|---|---|---|
| View data | Yes | Yes | Yes | Yes | Yes | Access to the data tables. A permission filter narrows it further. |
| Download files | Yes | Yes | Yes | Yes | Yes | Access to the Filebox. Exporting a report or dashboard needs access to that element and to the tables behind it. |
| Upload and submit data | No | Yes | Yes | Yes | Yes | Editor or Owner on the Filebox. |
| Create tables and grant access to them | No | No | Yes | Yes | Yes | You own the tables you create. To grant access to an existing table, you must be its Owner. Admins don't own tables automatically. |
| Share elements | No | No | Yes | Yes | Yes | Owner on the element. Sharing an element doesn't give access to the table data behind it. |
| Manage and map data | No | No | Yes | Yes | Yes | Owner on the table. Owner on the Filebox isn't enough. |
| Create and manage workflows | No | No | Yes | Yes | Yes | Editor or Owner on an existing workflow. Collaborators can be assigned tasks without either. |
| Create dashboards and storyboards | No | No | Yes | Yes | Yes | Each person sees only the rows their table access allows, so the same dashboard can show different numbers to two people. |
| Create reports and report spaces | No | No | Yes | Yes | Yes | To open a report, a person needs access to its report space, not only the report. Neither gives access to the data. |
| Sync integrations | No | No | Yes | Yes | Yes | Editor or Owner on the connected Fileboxes, and Sync or Owner on the data source. |
| Manage data sources and integrations | No | No | Yes | Yes | Yes | Owner on the data source to edit it. |
| Manage permissions on elements | No | No | Yes | Yes | Yes | Owner on the element. Only a Super Admin can change access on an element that was never shared with them. |
| Manage organization settings | No | No | No | Yes | Yes | Nothing else. This applies to the whole organization. |
| Manage members | No | No | No | Yes | Yes | An Admin can assign roles up to Admin. Only a Super Admin can assign the Super Admin role. |
| Manage groups | No | No | No | No | Yes | Nothing else. |
| Automatic access to all elements | No | No | No | No | Yes | An Admin sees only what they created or were shared on. |
What each access level allows, by element
Data tables
Table access is what controls the data a person sees. See Controlling data access with tables and permissions.
| Level | What it allows |
|---|---|
| Viewer | View the table's data. You can limit a Viewer with a permission filter. |
| Owner | See all of the table's data, edit and delete the table, and manage who has access to it. A permission filter can't be applied to an Owner. |
Data sources
| Level | What it allows |
|---|---|
| Sync | Sync the connected Fileboxes. Also needs Editor or Owner on those Fileboxes. |
| Owner | Edit the integration settings, manage sync schedules, and share the data source. |
Fileboxes, folders and collections
| Level | What it allows |
|---|---|
| Viewer | View documents and data. |
| Editor | Upload and manage document versions, and view and edit content. |
| Owner | Everything an Editor can do, plus approve workflows, assign versions, edit metadata, manage collaboration, lock and delete. |
Fileboxes mapped to a table: When a Filebox is mapped to a data table, what a person can do with it depends on both their Filebox access and their table access. Someone with access to the Filebox but not to the table can upload and view content, but can't delete or archive the Filebox, or create and edit its data mappers.
Report spaces
| Level | What it allows |
|---|---|
| Viewer | View reports. |
| Editor | View and manage reports. |
| Owner | Full control of the report space, including renaming reports. |
Workflows
| Level | What it allows |
|---|---|
| Editor | Edit the workflow, clone instances, assign members, lock tasks and mark them complete. |
| Owner | Create, configure, activate, deactivate, archive, delete and share workflows, and manage their members. |
Dashboards
| Level | What it allows |
|---|---|
| Viewer | View the dashboard. |
| Editor | View the dashboard and change its filters and widgets. |
| Owner | Change the dashboard, its filters and widgets, and share it and manage access. |
Storyboards
| Level | What it allows |
|---|---|
| Viewer | View stories. |
| Editor | Add and change stories. |
| Owner | Add, change, delete and share stories. |
Product permissions
Each Datarails product has its own permissions. Access to a product must be shared with a person, except for Super Admins, who have access to every product. A product also needs access to its tables, so Datarails prompts you to grant table access when you share the product.
Month-End Close
| Level | What it allows |
|---|---|
| Viewer | View the Summary and Reconciliation screens. The data shown depends on the person's access to the Trial Balance table. |
| Editor | Everything a Viewer can do, plus take part in shared workflows and tasks, and perform reconciliation actions. |
| Owner | Everything an Editor can do, plus open Month-End Close settings and fully manage reconciliations. Only Admins and Super Admins can be Owners. |
Cash
| Level | What it allows |
|---|---|
| Viewer | View all Cash pages (transactions and balances). The data shown depends on the person's access to the Bank_Transactions and Bank_Balances tables. |
| Owner | Everything a Viewer can do, plus manage rules, edit transaction categories, and share Cash with others. |
Group permissions
A group lets you share an element with several people at once. Group permissions follow the same rules as individual permissions.
- The highest access wins. If a person has access to an element both directly and through a group, the higher level applies. Joining a Viewer group never reduces a person's own Owner access.
- A group's level is limited by its lowest role. A group can only hold an access level that every member's system role allows. If you share an element with a group at a level some members can't hold, Datarails lists those members and asks how to continue. If you continue, the group gets the highest level that all its members can hold.
When roles or membership change
| Change | What happens |
|---|---|
| You add a member whose role is lower than the group's current level allows | Datarails warns you first. If you continue, the group's level drops on the elements shared with it. Members whose access came only from the group lose the higher level. Members who also have the access directly keep it. |
| You lower the role of a member who is already in a group | Only that member's access is reduced to what their new role allows. The group's level doesn't change, other members aren't affected, and the member stays in the group. |
How group access is shown
- An information icon next to a person's access level means the access comes from a group, not from a direct share.
- Hover over a group's name to see its members.
© Datarails Ltd. All rights reserved.
Updated