> ## Documentation Index
> Fetch the complete documentation index at: https://help.superhawk.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> How permission sets, resources, actions, and scopes control access in Superhawk.

Access in Superhawk is controlled by **permission sets**. A permission set is a collection of grants, and each grant answers three questions: what resource, what action, and over how much of it.

## The three dimensions

### Resource

What is being protected:

| Resource             | Covers                                   |
| -------------------- | ---------------------------------------- |
| `accounts`           | Customer accounts and everything on them |
| `contacts`           | People at those accounts                 |
| `companies`          | Company records                          |
| `deals`              | CRM deal records                         |
| `activities`         | Calls, emails, and meetings              |
| `reports`            | Generated reports                        |
| `integrations`       | Connected data sources                   |
| `members`            | Workspace membership                     |
| `teams`              | Team structure                           |
| `workspace_settings` | Workspace configuration                  |

### Action

What can be done: **view**, **create**, **edit**, or **delete**.

### Scope

How much of the resource the grant covers:

| Scope  | Means                                  |
| ------ | -------------------------------------- |
| `all`  | Every record in the workspace          |
| `team` | Records belonging to the member's team |
| `own`  | Only records the member owns           |
| `none` | No access                              |

**Scope is the dimension people underestimate.** "Can view accounts" is not one permission -- viewing every account in the business and viewing the twelve you own are very different grants, and the difference is scope.

## Built-in permission sets

Three sets ship with every workspace and cover the common cases.

### Owner

Full control. Manages billing, transfers ownership, and can change any other member's access. Exactly one per workspace, assigned to whoever created it.

### Admin

Manages the workspace day to day: members, teams, integrations, and settings, with access across all accounts. Cannot manage billing or transfer ownership.

### Member

The working set for a CSM or account owner. Views and works accounts, signals, tasks, and reports, typically scoped to their own or their team's accounts. Cannot change integrations, membership, or workspace settings.

## Custom permission sets

Where the built-in three do not fit, custom sets can be defined. Common shapes:

* **Read-only stakeholder** -- view across all accounts, create and edit nothing
* **Regional lead** -- full working access scoped to `team`
* **Integrations owner** -- manage integrations without account-level access
* **Analyst** -- view everything, generate reports, change nothing

<Note>
  Creating and assigning permission sets requires admin access. Talk to your workspace admin or your Superhawk representative about a set you need.
</Note>

## Teams and scoped access

Scoped permissions only do useful work when teams are set up, because `team` scope resolves through team membership. A workspace with everyone in no team effectively has only `all` and `own` available.

## Auditing

Permission changes are recorded: who changed what, for whom, and when. Membership changes and ownership transfers are recorded the same way.

## Related

* [Members & Invites](/team/members-and-invites)
* [Team & Access](/team/overview)