> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission & Access Control

Define what team members can see and do by creating roles with specific permissions. This ensures that users only have access to the information and actions relevant to their responsibilities.

## How Permissions Work

Our access control system is built on roles and policies. This combination allows for flexible and granular control over user permissions.

* **Roles**: A role is a collection of permissions that you can assign to users. We provide system roles with pre-defined permissions, and you can also create custom roles.
* **Policies**: A policy defines a specific permission. It consists of an action (like "read" or "create") and a resource (like "Jobs" or "Candidates"). Each policy either allows or denies the action on the resource.
* **Resources**: These are the different areas of the platform you can control access to, such as Jobs, Candidates, and Settings.
* **Actions**: These are the operations a user can perform on a resource, like creating, reading, editing, or deleting.

## Core Concepts

### Available Actions

You can grant users the ability to perform the following actions on different resources:

* **Create**: Add new items, such as creating a new job.
* **Read**: View information, such as looking at a list of candidates or opening a job.
* **Update**: Edit existing items, such as changing a job's settings.
* **Delete**: Remove items, such as deleting a job.
* **Manage**: Full permission to perform all actions on a resource.

### Available Resources and Permissions

You can set permissions for the following resources. Note that not all actions are available for every resource.

| Resource             | Allowed Actions                    |
| :------------------- | :--------------------------------- |
| **Dashboard**        | Can access                         |
| **Jobs**             | Can read, edit, create, and delete |
| **Sessions**         | Can read, edit, and delete         |
| **Candidates**       | Can read                           |
| **Workflows**        | Can read, edit, create, and delete |
| **Templates**        | Can read, edit, create, and delete |
| **Interview Guides** | Can read, edit, create, and delete |
| **Talent Match**     | Can access; can configure match    |
| **Integrations**     | Can manage                         |
| **Users**            | Can manage users                   |
| **Global Settings**  | Can manage                         |

### Additional Job-Level Permissions

For the **Jobs** resource, you can grant these additional permissions:

* Can access settings tab
* Can access interview guides tab
* Can access analytics tab

### Additional Workflow-Level Permissions

For the **Workflows** resource, you can grant this additional permission:

* Can edit email configuration

## System Roles

We provide three default system roles to get you started.

| Resource         | Admin  | Recruiter   | Evaluator          |
| :--------------- | :----- | :---------- | :----------------- |
| Dashboard        | Manage | Manage      | —                  |
| Jobs             | Manage | Manage      | Read (shared only) |
| Sessions         | Manage | Manage      | Read (shared only) |
| Candidates       | Manage | Manage      | —                  |
| Workflows        | Manage | Read        | —                  |
| Templates        | Manage | Manage      | —                  |
| Interview Guides | Manage | Manage      | —                  |
| Talent Match     | Manage | Access only | —                  |
| Integrations     | Manage | —           | —                  |
| Users            | Manage | —           | —                  |
| Global Settings  | Manage | —           | —                  |

* **Admin**: Full access on every resource.
* **Recruiter**: Full access to jobs (including all sub-tabs), sessions, candidates, templates, interview guides, and the dashboard. Read-only on workflows — cannot create or edit them. Can access Talent Match but cannot configure match queries. No access to integrations, users, or global settings.
* **Evaluator**: Read-only access to jobs and sessions that have been explicitly shared with them. No other access.

## Custom Roles

For more specific needs, you can create your own roles with tailored permissions.

### Create a Custom Role

1. Navigate to **Settings > Team** and select the **Roles and Permissions** tab.
2. Click **Create a Role**.
3. Enter a descriptive **Role Name** (e.g., "Regional Manager").
4. Select which permissions to grant for each resource (Dashboard, Jobs, etc.) by checking the corresponding boxes.
5. Click **Create Role** to save.

New custom roles start with full **Templates** and **Interview Guides** access by default. All other resources (Talent Match, Integrations, Users, Global Settings, etc.) are opt-in and must be explicitly granted.

## Conditional Policies

You can add conditions to policies to restrict access to jobs based on specific criteria. This is useful for roles that should only manage a subset of jobs.

When editing a role, you can set conditions for Job permissions based on:

* **Label**: Restrict access to jobs with a specific label.
* **Created by**: Limit access to jobs created by the user themselves.

## How Permissions are Evaluated

When a user tries to perform an action, the system checks permissions in the following order:

1. **Admin Check**: The system first checks if the user has an Admin role with full access. If so, the action is allowed.
2. **Policy Evaluation**: If the user is not an Admin, the system evaluates all policies assigned to their role. If an "allow" policy matches the action, it is permitted. However, a "deny" policy will always override an "allow" policy.
3. **Default Deny**: If no policies specifically allow the action, it is denied by default.

## Managing Roles

You can create, edit, and assign roles from the Team settings page.

1. Navigate to **Settings > Team**.
2. Select the **Roles and Permissions** tab to view, create, or edit roles.
3. Select the **Team Members** tab to assign roles to your users. Find the user in the list and select the desired role from the dropdown menu in the "Role" column.