Four roles and what each can do across every client. Super admin is locked on.
Super admin
3 people
Everything, including deleting clients, billing and roles
Admin shell, every client and Settings
Account lead
4 people
Owns assigned clients: approves canon, signs scopes
Admin shell scoped to their clients, no Settings
Member
6 people
Works inside assigned clients: drafts, notes, apps
Member shell, assigned clients
Client guest
0 people
Reads one client’s approved canon. Never drafts
Client portal, one client, approved notes only
Permission matrix
10 capabilities by role. Every change is written to the audit log
Unsaved changes
Capability Super adminAccount leadMemberClient guest
Add a client
Start onboarding and create its vault folder
Delete or archive a client
Archive the client and revoke every member’s access
Approve brand canon
Promote a draft note to approved
Sign scopes and proposals
Send, sign and change contracted work
Run apps
PreSocial, PreDeck, PreQA, PreLaunch and the rest
Edit the knowledge base
Draft notes and register sources
View the client
Knowledge base, design system and artifacts
Manage members, roles and client access
Invite people, change roles, choose clients
Install apps, connectors and keys
Connect Drive and Slack, rotate keys
Change governance
Approval gates, knowledge rules and retention
Super admin is locked on, so a super admin can never lose access. Account leads use the admin shell scoped to their clients, without Settings. Client guests only see approved notes for one client.
[ Super admin only ]
New role
A role starts as a copy of an existing one. Change its permissions on Roles and permissions, then assign it from Members.
Shown in the members table and the role menu.
Super admin is locked and cannot be copied.