Permissions and access
Three separate things have to agree before you can do something. Each fails differently, and telling them apart is what sends you to the right person.
- Your rolesWhat you may do. Fails by the control not being there. An administrator fixes it.
- Your planWhat the workspace bought. Fails with a message. Only a plan change fixes it.
- The item's accessWho this one thing was shared with. Fails per item. Its owner fixes it.
Each gate narrows. None can widen another.
1. Your roles
A role is a named list of things you may do. You hold one or more, and holding two grants everything in both. Roles only add. No role takes something away.
When this is what stopped you: the screen or button is not there at all. The app does not show a disabled control; it shows a shorter menu.
Who fixes it: an administrator, in seconds. See users and roles.
2. Your plan
Whole areas of the product belong to modules, and a workspace only holds the modules its subscription includes.
When this is what stopped you: an explicit message saying your plan does not include this.
Who fixes it: whoever owns billing, and only by changing the plan. No role change opens it, because the entitlement belongs to the subscription rather than to you. See plans and modules.
This gate is the one most often misdiagnosed. If you have asked an administrator for access three times and still cannot see something, check whether the message is about your plan rather than your permissions.
3. Who the item was shared with
Roles decide which screens you get. They do not decide which items you see inside them. That is controlled by the access list on the item itself, Who can use this.
A Designer can open the design editor. Whether they can open your design depends on
whether you restricted it.
When this is what stopped you: the screen works, but a particular item is missing or read-only.
Who fixes it: whoever owns the item. See sharing and access.
Credits are a fourth limit
Credits are not a permission, but they stop work in the same way. When the workspace pool is empty, AI features pause for everyone regardless of roles or plan. Ordinary work continues.
Who fixes it: a top-up. See usage and credits.
Which gate stopped you
| What you see | Which gate | What helps |
|---|---|---|
| The screen or control is not there | Roles | A role change |
| A message that your plan does not include it | Plan | A plan change |
| The screen works but an item is missing or read-only | Item access | Ask its owner |
| "You're out of credits" | Credits | A top-up |
See your own permissions
If you have access to Administration → Users, open your own user record and read Combined permissions: your roles plus any custom grants, after the plan has been applied. That is what you actually hold, rather than what your roles imply.
Building against the API rather than using the app? The same three gates apply to API keys, with a fourth narrowing on top, the key's own scope. See roles and permissions in the developer documentation.