Permission & Access Control

Define what team members can see and do by creating roles with specific permissions. This ensures that users only have access to the information and actions relevant to their responsibilities.

How Permissions Work

Our access control system is built on roles and policies. This combination allows for flexible and granular control over user permissions.

• Roles: A role is a collection of permissions that you can assign to users. We provide system roles with pre-defined permissions, and you can also create custom roles.
• Policies: A policy defines a specific permission. It consists of an action (like “read” or “create”) and a resource (like “Jobs” or “Candidates”). Each policy either allows or denies the action on the resource.
• Resources: These are the different areas of the platform you can control access to, such as Jobs, Candidates, and Settings.
• Actions: These are the operations a user can perform on a resource, like creating, reading, editing, or deleting.

Core Concepts

Available Actions

You can grant users the ability to perform the following actions on different resources:

• Create: Add new items, such as creating a new job.
• Read: View information, such as looking at a list of candidates or opening a job.
• Update: Edit existing items, such as changing a job’s settings.
• Delete: Remove items, such as deleting a job.
• Manage: Full permission to perform all actions on a resource.

Available Resources and Permissions

You can set permissions for the following resources. Note that not all actions are available for every resource.

Resource	Allowed Actions
Dashboard	Can access
Jobs	Can read, edit, create, and delete
Sessions	Can read, edit, and delete
Candidates	Can read
Workflows	Can read, edit, create, and delete
Templates	Can read, edit, create, and delete
Interview Guides	Can read, edit, create, and delete
Talent Match	Can access; can configure match
Integrations	Can manage
Users	Can manage users
Global Settings	Can manage

Additional Job-Level Permissions

For the Jobs resource, you can grant these additional permissions:

• Can access settings tab
• Can access interview guides tab
• Can access analytics tab

Additional Workflow-Level Permissions

For the Workflows resource, you can grant this additional permission:

• Can edit email configuration

System Roles

We provide three default system roles to get you started.

Resource	Admin	Recruiter	Evaluator
Dashboard	Manage	Manage	—
Jobs	Manage	Manage	Read (shared only)
Sessions	Manage	Manage	Read (shared only)
Candidates	Manage	Manage	—
Workflows	Manage	Read	—
Templates	Manage	Manage	—
Interview Guides	Manage	Manage	—
Talent Match	Manage	Access only	—
Integrations	Manage	—	—
Users	Manage	—	—
Global Settings	Manage	—	—

• Admin: Full access on every resource.
• Recruiter: Full access to jobs (including all sub-tabs), sessions, candidates, templates, interview guides, and the dashboard. Read-only on workflows — cannot create or edit them. Can access Talent Match but cannot configure match queries. No access to integrations, users, or global settings.
• Evaluator: Read-only access to jobs and sessions that have been explicitly shared with them. No other access.

Custom Roles

For more specific needs, you can create your own roles with tailored permissions.

Create a Custom Role

1. Navigate to Settings > Team and select the Roles and Permissions tab.
2. Click Create a Role.
3. Enter a descriptive Role Name (e.g., “Regional Manager”).
4. Select which permissions to grant for each resource (Dashboard, Jobs, etc.) by checking the corresponding boxes.
5. Click Create Role to save.

New custom roles start with full Templates and Interview Guides access by default. All other resources (Talent Match, Integrations, Users, Global Settings, etc.) are opt-in and must be explicitly granted.

Conditional Policies

You can add conditions to policies to restrict access to jobs based on specific criteria. This is useful for roles that should only manage a subset of jobs.

When editing a role, you can set conditions for Job permissions based on:

• Label: Restrict access to jobs with a specific label.
• Created by: Limit access to jobs created by the user themselves.

How Permissions are Evaluated

When a user tries to perform an action, the system checks permissions in the following order:

1. Admin Check: The system first checks if the user has an Admin role with full access. If so, the action is allowed.
2. Policy Evaluation: If the user is not an Admin, the system evaluates all policies assigned to their role. If an “allow” policy matches the action, it is permitted. However, a “deny” policy will always override an “allow” policy.
3. Default Deny: If no policies specifically allow the action, it is denied by default.

Managing Roles

You can create, edit, and assign roles from the Team settings page.

1. Navigate to Settings > Team.
2. Select the Roles and Permissions tab to view, create, or edit roles.
3. Select the Team Members tab to assign roles to your users. Find the user in the list and select the desired role from the dropdown menu in the “Role” column.