Workspace roles, Owner, Admin, Member, Viewer
Four universal roles plus scoped roles for specific programs. Owners do everything; Admins do everything except billing/ownership; Members run campaigns; Viewers read-only.
The four universal roles
| Role | Highlights |
|---|---|
| Owner | Everything, billing, transfer ownership, delete workspace |
| Admin | Everything except billing/ownership |
| Member | Run campaigns within their scoped Brands |
| Viewer | Read-only |
A workspace can have multiple Owners. Members can be scoped to one or more Brands.
Scoped program roles
Enabled when you enable a program:
- HR Manager (Employee Advocacy), sees
employees.*only, no influencer/customer data - Reviewer (EA post library), approves/rejects employee posts, no other access
- Account Manager (assigned by Keepface), works alongside Managed-mode campaigns
Permission detail
Most permission decisions are at the resource × action level (e.g. campaigns.create, wallet.view). Default role assignments are in Workspace settings → Roles; override individual permissions per-member if you need finer-grained control.