Permissions
Which permission each Studio page and action needs, what each Studio role holds by itself and what the predefined permission sets contain.
This page is the reference for who may see and change what in the Studio. How Studio roles, permission sets and units work, and how to assign them, is explained in Studio users and roles.
Two rules hold everywhere:
- Manage includes read. Whoever holds an area's manage permission sees everything its read permission shows.
- Without the permission, the page is not there. The sidebar leaves out what a Studio user may not see, and its address shows "Page not found". A reader sees no button that needs the manage permission. The Studio checks every change again when it is saved.
The permissions
| Permission | What it allows | Under "Permission sets" |
|---|---|---|
community.read | See the registers, the membership definition, the members directory with the check lookup, and the communities. | "Community: read" |
community.manage | Change them, upload and download register entries, generate challenge codes, connect external registers and query member codes. | "Community: manage" |
frontends.read | See the frontends with their settings, released claims and guest access, and the sign-in branding. | "Frontends: read" |
frontends.manage | Create and change frontends, issue their keys, set up their sign-in, change the sign-in branding, and disconnect frontends. | "Frontends: manage" |
frontend-users.read | Find frontend users and open their pages. | "Frontend users: read" |
frontend-users.manage | Block and unblock frontend users and export their data. | "Frontend users: manage" |
vouchers.read | See the voucher offers, their voucher pools and the partners, with the codes masked. | "Vouchers: read" |
vouchers.manage | Change them, show codes in full, import codes and the Portal's offers, and the voucher settings. | "Vouchers: manage" |
redemptions.manage | The redemption office: find and handle redemptions, and the redemption settings. It has no read level. | "Redemptions: manage" |
settings.manage | Change the organisation's name, its address in the Studio and its logo. | – |
invites.manage | Invite Studio users and manage the pending invitations. | – |
members.manage | Change the Studio role, permission sets and units of Studio users ranked below, and remove them from the organisation. With it, owners and administrators also keep the units and the organisation's own permission sets. | – |
billing.manage | Choose the plan and manage the payment details. | – |
roles.manage | Held by the owner; no page or action of the Studio asks for it. | – |
The last five go with the Studio roles only: no permission set can hold them.
What each Studio role holds
The permissions a Studio role holds by itself, without any permission set. ✓ means the role holds the permission; a read permission comes with its area's manage permission.
| Permission | "Owner" | "Administrator" | "Manager" | "Editor" | "Stakeholder" |
|---|---|---|---|---|---|
community.read | ✓ | ✓ | – | – | – |
community.manage | ✓ | ✓ | – | – | – |
frontends.read | ✓ | ✓ | – | – | – |
frontends.manage | ✓ | ✓ | – | – | – |
frontend-users.read | ✓ | ✓ | – | – | – |
frontend-users.manage | ✓ | ✓ | – | – | – |
vouchers.read | ✓ | ✓ | – | – | – |
vouchers.manage | ✓ | ✓ | – | – | – |
redemptions.manage | ✓ | ✓ | – | – | – |
settings.manage | ✓ | ✓ | – | – | – |
invites.manage | ✓ | ✓ | – | – | – |
members.manage | ✓ | ✓ | – | – | – |
billing.manage | ✓ | – | – | – | – |
roles.manage | ✓ | – | – | – | – |
The columns follow the ranking, "Owner" first. A "Manager", "Editor" or "Stakeholder" holds nothing by their role: what they may do in the areas comes only from their permission sets. A "Manager" also looks after the Studio users of their units, by the role itself, see Studio users below.
Who can hold permission sets:
- "Owner" and "Administrator": none. Their roles already hold every area permission.
- "Manager" and "Editor": any set.
- "Stakeholder": read-only sets only, without any manage permission.
The predefined permission sets
| Permission set | Permissions |
|---|---|
| "Community: read" | community.read |
| "Community: manage" | community.manage |
| "Frontends: read" | frontends.read |
| "Frontends: manage" | frontends.manage |
| "Frontend users: read" | frontend-users.read |
| "Frontend users: manage" | frontend-users.manage |
| "Voucher viewer" | vouchers.read |
| "Voucher manager" | vouchers.manage |
No predefined set holds redemptions.manage. For the redemption office, owners and administrators compose an organisation's own set with "Redemptions: manage", see Permission sets. Pannoniqa AG, for example, gives its redemption office a set "Redemption office" with "Redemptions: manage" and "Vouchers: read", so that its staff also open the voucher offers.
Pages and actions
Each table names a page by its label in the sidebar, then what you can do there, with the permission it needs. "Owner" and "Administrator" hold every permission these tables name, unless a row names a Studio role. "Dashboard" is open to every Studio user; each of its tiles shows only with the permission of the page it links to, see Dashboard.
Community
| Page | Action | Needs |
|---|---|---|
| "Registers" | See the registers, their entries and the "Activity" | community.read |
| "Registers" | "New register"; "Add entry", "Edit" and "Deactivate" an entry | community.manage |
| "Registers" | "Upload file" and "Download" | community.manage |
| "Registers" | "Generate challenge codes" | community.manage |
| "Registers" | A register's "Settings" behind the gear, its claims with "Add claim", an external register's connection and "Test connection" | community.manage |
| "Registers" | "Delete register" | "Owner" |
| "Membership definition" | See the current version and the "Version history" | community.read |
| "Membership definition" | The editor: "Add register", "Edit filters", the preview with "Eligible persons", "Save and publish" | community.manage |
| "Member code query" | Open the page and query a member code | community.manage |
| "Members directory" | Find members, open a member's page, "Check lookup" | community.read |
| "Members directory" | "Deactivate" and "Anonymize now" a membership | community.manage |
| "Communities" | See the communities and their filters | community.read |
| "Communities" | "New community", change the name or description, "Add filter", "Delete community" | community.manage |
On a member's page, the holder's email leads to their frontend user page for Studio users who also hold frontend-users.read.
Frontends
| Page | Action | Needs |
|---|---|---|
| "Frontends" | See the frontends, their "Settings", "Released claims" and "Guest access", and the "Sign-in branding" | frontends.read |
| "Frontends" | "New frontend", change a frontend's "Settings" | frontends.manage |
| "Frontends" | The cards "Keys" ("Issue key", "Revoke") and "Sign-in" ("Rotate secret"), which a reader does not see | frontends.manage |
| "Frontends" | "Save released claims", "Save guest access" | frontends.manage |
| "Frontends" | "Save branding" on the "Sign-in branding", the support address included | frontends.manage |
| "Frontends" | "Disconnect frontend" and "Reconnect" | frontends.manage |
Frontend users
| Page | Action | Needs |
|---|---|---|
| "Frontend users" | Find frontend users and open their page with profile, organisation membership, frontends, sign-ins and history | frontend-users.read |
| "Frontend users" | "Block", "Unblock" and "Export data" | frontend-users.manage |
On a frontend user's page, the organisation membership leads to the members directory for Studio users who also hold community.read.
Vouchers
The sidebar group "Vouchers" shows with vouchers.read or redemptions.manage.
| Page | Action | Needs |
|---|---|---|
| "Voucher offers" | See the voucher offers and their voucher pools with stock, the codes masked | vouchers.read |
| "Voucher offers" | "New voucher offer", "Edit", "Activate", "Pause" and "End" | vouchers.manage |
| "Voucher offers" | "Import from the Portal", and the "Voucher settings" behind the gear | vouchers.manage |
| "Voucher offers" | "Create voucher pool", "Import codes", "Show", "Withdraw", "Withdraw by list" and a pool's settings | vouchers.manage |
| "Voucher offers" | "All redemptions" on an offer's page | redemptions.manage |
| "Partners" | See the partners and their voucher offers | vouchers.read |
| "Partners" | "New partner", "Edit", "Archive", "Restore" and "Delete" | vouchers.manage |
Redemptions
| Page | Action | Needs |
|---|---|---|
| "Redemptions" | Find redemptions and open them | redemptions.manage |
| "Redemptions" | Set the status and the note under "Status and note" | redemptions.manage |
| "Redemptions" | "Redemption settings" behind the gear | redemptions.manage |
On a redemption, the voucher offer leads to its page for Studio users who also hold vouchers.read, and "Open the member page" shows for those who hold community.read.
Organisation settings
| Page | Action | Needs |
|---|---|---|
| "Settings" | See the page | every Studio user |
| "Settings" | "Update Organisation" (name and address) and the "Organisation Logo" | settings.manage |
| "Settings" | "Leave Organisation" | every Studio user but the primary owner |
| "Settings" | "Profile": your own profile | every Studio user |
Studio users
| Page | Action | Needs |
|---|---|---|
| "Studio users" | See the Studio users, the "Pending Invites", the "Units" and the "Permission sets" | every Studio user |
| "Studio users" | "Invite Studio Users" | invites.manage; a "Manager" invites editors and stakeholders into their units |
| "Studio users" | "Update Invitation", "Renew Invitation", "Remove Invitation" | whoever could send the invitation |
| "Studio users" | "Update Role" | members.manage, for Studio users ranked below; a "Manager" moves the Studio users of their units between "Editor" and "Stakeholder" |
| "Studio users" | A Studio user's "Permission sets": "Assign" | whoever may manage the Studio user (members.manage, for Studio users ranked below, or a "Manager", for the Studio users of their units), holding every permission of the set |
| "Studio users" | A Studio user's "Permission sets": "End" | whoever may manage the Studio user; holding the set's permissions is not needed |
| "Studio users" | A Studio user's "Units" | adding: "Owner" and "Administrator"; removing: also a "Manager", from their units |
| "Studio users" | "Create unit", rename and delete units; "New permission set", "Edit" and "Delete" the organisation's own sets | "Owner" and "Administrator", from permissions they hold |
| "Studio users" | "Remove from Organisation" | members.manage, for Studio users ranked below |
| "Studio users" | "Transfer Ownership" | the primary owner |
An "Owner" can also invite owners and make other Studio users owners. Only the primary owner changes another owner's role.
Billing
| Page | Action | Needs |
|---|---|---|
| "Billing" | Choose a plan and manage the payment details | billing.manage, so "Owner" |
Roadmap
The roadmap is open to every Studio user signed in with their Studio account, whatever their Studio role. It is linked in the menu at the top of this website, not in the sidebar.