Permissions & Access Control

Understanding how permissions and access control work in Alex

Overview

Alex uses a flexible Policy-Based Access Control system that allows fine-grained control over what users can do within the platform.

Each user is assigned a role that contains a set of policies. These policies define which resources a user can access and what actions they can perform.

Core Concepts

Actions

Actions define what operations a user can perform on a resource:

Action	Description
Create	Create new records
Read	View/read records
Update	Modify existing records
Delete	Remove records
Manage	Full access (includes all actions above)

Available Resources

Resources represent the entities and features that can be controlled through policies.

Resource	Available Actions	Description
Dashboard	Access	Access to the dashboard page
Jobs	Read, Edit, Create, Delete	Job records and their configuration
Sessions	Read, Edit, Delete	Interview session records
Candidates	Read	Candidate records
Workflows	Read, Edit, Create	Automation workflows
Global Settings	Manage	Company-wide settings and configuration

Jobs: Additional Permissions

When configuring Jobs permissions, you can also control access to:

Permission	Description
Can access settings	Access to job configuration settings
Can access kit	Access to interview guide management
Can access analytics	Access to job analytics and reporting

System Roles

Alex includes built-in system roles that provide common permission configurations.

Role	Description
Admin	Full access to all resources, including Global Settings
Recruiter	Full access to day-to-day operations, without Global Settings
Hiring Manager	Limited access to view sessions and jobs shared with them

Admin

Full administrative access to the company account, including all resources and Global Settings.

Recruiter

Full access to day-to-day operations, without Global Settings:

• Dashboard: Full access
• Jobs: Full access (including settings, kit, and analytics)
• Sessions: Full access
• Candidates: Full access
• Workflows: Read
• Templates: Full access
• Labels: Full access

Hiring Manager

Limited access for evaluators who review shared candidates:

• Jobs: Read only for jobs with sessions shared to them
• Sessions: Read only for sessions shared to them

Hiring managers have restricted decision options. They can only set candidate decisions to:

• Shortlisted
• Rejected
• No decision

They cannot set final decisions like Placed, Hired, or Submitted.

Custom Roles

In addition to system roles, you can create custom roles with specific permissions tailored to your organization’s needs. Custom roles give you full control over which resources and actions are available to users.

Conditional Policies

For Jobs, you can add conditions to restrict which specific jobs a user can access.

Condition	Description
Label	Filter access by job labels (e.g., “Engineering”, “Sales”)
Created by	Restrict to jobs created by specific users, or “self” for the user’s own jobs
Workflow	Filter by assigned workflow

Conditions can be combined. For example, a user might only be able to edit their own jobs that also have specific labels.

How Permissions are Evaluated

1. Admin Check: Users with full “manage all” access receive admin privileges.

2. Policy Evaluation: For other users, each policy is evaluated:

   • Allow policies grant access
   • Deny policies explicitly block access (useful for exceptions)

3. Default Deny: If no policy explicitly allows an action, it is denied by default.

Managing Roles

Roles can be managed through the Alex dashboard under Settings > Team > Roles. Each role contains:

• Name: A descriptive name for the role
• Policies: The set of policies that define what users with this role can do

When you assign a role to a user, they inherit all the policies defined in that role.

Best Practices

Principle of Least Privilege

Grant users only the permissions they need to perform their job functions.

Use Deny Sparingly

Prefer granting specific permissions rather than allowing everything and denying exceptions.

Review Before Assigning

Verify a role has the intended access before assigning it to team members.

Audit Regularly

Review role assignments periodically to ensure they align with current responsibilities.