Skip to main content

Permission Matrix

Roles

Organization Admin · Event Coordinator · Treasurer · Board Member · Document Manager · Family Lead · Family Worker · Guest Worker · Venue Admin · Venue Coordinator · Gate Attendant · Operator Admin · Operator Coordinator

This table shows the specific capabilities granted to each built-in role. Use it when deciding which role to assign to a user, or when deciding whether to create a custom role.

For a conceptual explanation of how roles and permissions work, see Understanding Roles and Permissions.


How to read this table

  • Full — the role has all permissions in this category
  • A short description — the role has specific (not all) permissions in this category; the description lists what is included
  • blank — the role has no permissions in this category

The Admin role is not listed — it bypasses all permission checks and can do everything.


NPO organization roles

Family Accounts

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View own accountYesYesYesYes
View all accountsYesYesYes
Edit own accountYesYes
Edit all accountsYes
Create/delete accountsYes
View own transactionsYesYesYesYes
View all transactionsYesYesYes
Manually add/edit transactionsYesYes
Export family dataYes

Event Management

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View eventsYesYesYesYesYes
Create and edit eventsYesYes
Delete eventsYes
Assign workersYesYes
Remove workersYesYes
Enter/edit commission dataYesYes
Toggle fund distributionYesYes
Record attendanceYesYes
View and export event reportsYesYesYes
Manage settlement templatesYes
Assign settlement templatesYesYes
Settle eventsYesYes
Reverse settlementsYes
Manage rostersYesYes
Record financialsYesYes

Scholarships

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
Submit own requestsYesYes
View all requestsYesYes
Approve or deny requestsYesYes
Process paymentsYesYes
Modify request detailsYes

Fund Management

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View fund balancesYesYesYes
Configure distribution ratesYes
Toggle fund deductionsYes
View fund transactionsYesYesYes
Export fund reportsYesYes

Documents

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
Upload own documentsYesYes
Upload for any familyYesYes
View own documentsYesYes
View all documentsYesYes
Manage document templatesYesYes
Distribute for signatureYesYes
View compliance reportsYesYesYes

Communication

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
Send messages to individualsYes
Send bulk communicationsYes
Manage notification templatesYes
View communication historyYes

System Administration

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
Create and edit rolesYes
Assign rolesYes
View rolesYes
Configure security policiesYes
Manage system settingsYes
View audit logsYes
Data backup and restoreYes

Admin Panel (user management)

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View user directoryYes
Manage users (create, edit, deactivate)Yes
Send invitationsYes
Force logout / revoke sessionsYes

Ledger, Billing, and API

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View ledgerYesYesYes
Create ledger entriesYesYes
Void ledger entriesYes
View billingYesYesYes
Manage billingYes
Create API tokensYes
View own API tokensYes
Revoke own API tokensYes

Library, Directory, and Other

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
View library contentYesYes
Manage library contentYes
View library analyticsYes
Manage library categoriesYes
View member directoryYesYes
Create announcementsYesYes
Manage announcementsYes
Manage FAQYes
Submit feedbackYesYesYes
Manage feedbackYes
View groupsYesYes
Manage groupsYesYes
Import / create familiesYes

Collaboration (cross-org)

PermissionOrg AdminEvent CoordinatorTreasurerBoard MemberDocument ManagerFamily LeadFamily WorkerGuest Worker
Manage partnershipsYesYes
Invite partners to eventsYesYes
Manage cross-org assignmentsYesYes
View collaboration detailsYesYes
Settle collaboration payoutsYes

Guest worker portal

PermissionGuest Worker
View own assigned eventsYes
View own assignment details and earningsYes

Venue and operator roles

Venue profile and staff

PermissionVenue AdminVenue CoordinatorGate AttendantOperator AdminOperator Coordinator
View venue profileYesYesYesYesYes
Manage venue profile and settingsYesYes
View venue staffYesYesYesYes
Manage venue staffYesYes
View venue billingYesYesYesYes
Manage venue billingYesYes
View venuesYesYesYes
Manage venuesYesYes

Operations and events

PermissionVenue AdminVenue CoordinatorGate AttendantOperator AdminOperator Coordinator
View operations dashboardYesYes
View system healthYes
Export operations metricsYes
View eventsYesYes
View and export event reportsYesYes

Groups, directory, and API

PermissionVenue AdminVenue CoordinatorGate AttendantOperator AdminOperator Coordinator
View groupsYesYes
Manage groupsYes
View member directoryYesYes
Create announcementsYesYes
Manage announcementsYes
Create API tokensYes
View own API tokensYes
Revoke own API tokensYes

Key rules

System roles cannot be edited

Admin and Venue Admin are system roles. Attempting to edit or delete them returns an error. All other built-in roles can be modified.

view_all implies view_own

Within a category, having a view_all permission automatically satisfies a view_own check. For example, a Treasurer with family_account.view_all does not also need family_account.view_own — the broader permission covers the narrower one. This applies only to view permissions; edit permissions do not chain.

Permission cache

Permission changes take effect within 5 minutes. When you change a user's roles, their cache is cleared immediately. When you edit a role's permission set, all users' caches are cleared at once. Either way, the change is reflected on each user's next request within the cache window.


Next Steps