Roles & Permissions

Joryio provides a granular Role-Based Access Control (RBAC) system that lets you define exactly what each team member can do. You assign access from one place - Settings → Team & Access - using built-in roles, pre-built templates, custom permission sets, or team membership.

How access works

Every member's access is resolved from three things, unioned together:

1. Workspace grants - a role (or a custom permission set) applied to all workspaces or to specific workspaces. This is where most permissions live.
2. Team membership - teams carry their own role + workspace scope and narrow visibility by tags (see the Teams section below).
3. Organization permissions - a small set of org-wide capabilities granted directly to the member.

Permissions follow a resource:action format (e.g., campaigns:read, campaigns:send).

Workspace-level vs. company-level permissions

This is the most important concept in the model:

• Workspace-level permissions (the majority - campaigns, journeys, audience, content, data, events, analytics, integrations, API keys, settings, compliance, touching rules, WhatsApp) govern resources that belong to a single workspace. They are carried by role grants per workspace and by teams - never granted globally.

• Company-level (org-wide) permissions are the only capabilities that apply everywhere regardless of workspace. They are granted as a direct checklist on the member, not through a role and not scoped to a workspace. There are exactly five:

  Permission	What it allows
  team:read	View members and their roles
  team:write	Invite, update, and remove members
  team:manage_roles	Create, edit, and delete custom roles
  workspaces:manage	Create, delete, and configure workspaces
  org_settings:write	Modify org-wide configuration - email/SMS providers, SMS keywords, Viber templates, general, tracking domain, privacy settings and data retention, wallet install landing page; also shows organization-level entries in the compliance audit log
  billing:read	View org-wide audit log, usage/spend breakdown, and wallet balance/ledger (spans all workspaces)

Everything not in that list is workspace-level. This split is why a member can be an admin in one workspace and have no access to another, while "manage members" or "manage workspaces" always applies across the whole organization.

Admins and owners

Admin and Owner bypass the resolver entirely - they always have every permission in every workspace. The split above matters for everyone else.

System roles

Admin has full access to every feature and setting, cannot be modified or deleted, and always reflects the current permission set - when a new permission is added to the platform, Admin gets it automatically. Owner is an alias of Admin.

Role	Description	Permissions
Admin / Owner	Full access to all features and settings	All permissions (always current)
Editor	Create and edit content; cannot delete, send, or manage settings/team/roles/API keys	Read + Write (no Delete, Send, settings:write, compliance:write, team:write, or api_keys:write)
Viewer	Read-only access to all data	All :read permissions

Template roles

Templates are pre-built starting points you can assign directly or clone and customize. Unlike Admin, a template is a fixed snapshot you maintain - it does not automatically gain new permissions when the platform adds them.

Template	Description	Key Permissions
Marketer	Create and send campaigns, manage audiences and templates	Campaigns (full), Journeys (full), Segments (read/write), Templates (read/write), Analytics (read), Users (read)
Developer	Manage integrations, events, and API keys	Events (read/write), Integrations (read/write), API Keys (read/write), Settings (read), Analytics (read)
Analyst	Read-only access to analytics, campaigns, and user data	Analytics (read), Campaigns (read), Journeys (read), Segments (read), Users (read), Events (read)

Permission categories

Permissions are organized into the following categories. Unless marked company-level, every category is workspace-level (granted per workspace through a role or custom set).

Campaigns

• campaigns:read - View campaigns and their statistics
• campaigns:write - Create and update campaigns
• campaigns:delete - Delete campaigns
• campaigns:send - Send, pause, resume, and cancel campaigns
• campaigns:test - Send a test of a campaign to your own address or device. Editors hold this by default so they can check their own work; a holder of this alone cannot send a test to anyone else, because a test uses the workspace's real sending identity. campaigns:send includes it.
• campaigns:approve - Approve or reject campaigns submitted for review. Separate from campaigns:send on purpose: agreeing a campaign is correct and releasing it are different decisions, so a workspace can require different people for each.

Journeys (Canvas)

• canvas:read - View journeys and their executions
• canvas:write - Create and update journeys
• canvas:delete - Delete journeys
• canvas:approve - Approve or reject journeys submitted for review. Separate from canvas:activate, so a workspace can require different people to review and to launch.
• canvas:activate - Activate, pause, and resume journeys
• canvas:enter - Add a person to a live journey (API-triggered entry, e.g. a Zapier "Add to journey" action). Carried by canvas:activate; on its own it cannot start, pause or edit the journey

Users

• users:read - View user profiles and attributes
• users:write - Create and update user profiles
• users:delete - Delete user profiles
• pii:view - Reveal PII-flagged custom-attribute values in contact views (otherwise masked; admins and owners always have it) It is also what an app connection such as Zapier needs, on top of the optional "See contacts' email address and phone number" box on its consent page, to receive contacts' email, phone and External ID - see Me API.
• agents:contacts - AI agents: contact data. Let an AI agent connected through MCP search, read and update people; offered only while the organisation allows AI agents to read contact data (Settings > General, off by default)

Landing pages

• landing_pages:read - View landing pages, their forms and their submissions
• landing_pages:write - Create and edit landing pages and their forms
• landing_pages:publish - Publish a landing page to its public URL and take it down (admins and owners)

Segments

• segments:read - View segments and their users
• segments:write - Create and update segments
• segments:delete - Delete segments

Templates

• templates:read - View email and in-app templates
• templates:write - Create and update templates
• templates:delete - Delete templates

Events

• events:read - Query event data and analytics
• event_schema:write - Define event schemas and the data dictionary
• events:track - Ingest events via SDK and server endpoints

Entities

• entities:read - View custom entities and their records
• entities:write - Create and update custom entities and records

Analytics

• analytics:read - View analytics dashboards and reports
• analytics:write - Create and modify dashboards, funnels, retention analyses, and saved queries

Settings (workspace)

• settings:read - View workspace settings
• settings:write - Modify workspace settings (monitoring, quiet hours, touching rules, subscriptions, apps & web push)
• settings:delete - Delete workspace settings resources

Integrations

• integrations:read - View configured integrations
• integrations:write - Configure and manage integrations
• hooks:manage - Webhook subscriptions: subscribe an external URL to workspace events and remove the subscription (REST hooks, e.g. Zapier triggers)
• lists:read - View subscription lists and their membership
• lists:write - Create, update and delete subscription lists, and change membership
• data_streaming:read - View configured event streams and their delivery health
• data_streaming:write - Configure event streams to your own sink
• users:alias - Attach and remove user aliases and external IDs (reading them is users:read)
• users:merge - Merge two user profiles into one
• users:export - Start and read segment export jobs
• subscriptions:read - Read a contact's channel and list subscription status
• subscriptions:write - Set a contact's channel and list subscription status
• apps:read - View apps, their SDK keys and push configuration
• apps:write - Create and configure apps and their push settings
• assets:read - View media-library assets
• assets:write - Upload and update media-library assets
• email_suppression:read - Read email bounce, spam and unsubscribe lists
• email_suppression:write - Modify email suppression entries
• sms_suppression:read - Read invalid and suppressed phone numbers
• sms_suppression:write - Clear the invalid-phone flag from users
• ai_agents:read - View AI agents and their run history
• ai_agents:write - Create, update, test and delete AI agents
• ecommerce:write - Create and update products, carts and orders

WhatsApp

• whatsapp:read - View WhatsApp Business accounts and templates
• whatsapp:write - Connect accounts and manage WhatsApp templates

Wallet

• wallet:read - View wallet pass accounts and issued passes
• wallet:write - Manage wallet credentials and issue/update passes

API Keys

• api_keys:read - View API keys (excluding secret values)
• api_keys:write - Create and update API keys
• api_keys:delete - Revoke and delete API keys

Compliance

• compliance:read - View compliance audit logs and DSR requests
• compliance:write - Process DSR requests and manage compliance settings

Touching Rules

• touching_rules:read - View frequency capping rules
• touching_rules:write - Configure frequency capping rules

Team Management - company-level

• team:read - View members and their roles
• team:write - Invite, update, and remove members
• team:manage_roles - Create, edit, and delete custom roles

Workspaces - company-level

• workspaces:manage - Create, delete, and configure workspaces

Organization Settings - company-level

• org_settings:write - Modify org-wide configuration (email/SMS providers, SMS keywords, Viber templates, general, tracking domain, privacy settings and data retention, wallet install landing page)
• billing:read - View org-wide audit log, usage/spend breakdown, and wallet balance/ledger (company-level, spans all workspaces)

Creating a custom role

1. Go to Settings → Team & Access → Roles
2. Click Create Role
3. Enter a name and description
4. Optionally select a template to clone permissions from
5. Check or uncheck individual permissions grouped by category
6. Click Save

Assigning access to a member

All member management lives under Settings → Team & Access → Members. Click Invite member (for a new person) or edit an existing member. The form has two parts. An invitation link works for 7 days. If it expires, open the member's row menu (the three dots) and choose Resend invitation - a new 7-day link is emailed and the old one stops working. The person you invite is signed straight into your organization when they accept; the email also tells them your account name and the link to sign in later (see Accepting an invitation). Invitation is the only way to add a member: an administrator never sets another person's password - the person you invite chooses their own when they accept.

1. Who

Name, email, phone (with a country-code selector, stored in E.164), and Department. Department is a select box - choosing Agency / Third Party automatically marks the member as External (there's no separate checkbox).

2. Access

A member's access is the union of one or more blocks. Stack as many as you need with + Add access (top-right of the Access card) - each block is independently one of:

Block	What it means
Assign a role	Reuse a saved role (system, template, or custom).
Custom permissions	Build a one-off permission set just for this member.
Team access	The member inherits each selected team's role and workspaces.

Blocks combine freely - for example Marketer in Production + a custom set in Staging + membership in Team X, all on one member. For Assign a role and Custom permissions blocks you also pick the Workspace access - All workspaces or a specific set.

• Assign a role → pick the role from the card grid (name, description, permission count).
• Custom permissions → tick exactly the workspace-level permissions, grouped by category, with a live "n of m selected" count and Select all / Clear all.
• Team access → choose one or more teams; each brings its own role and workspaces.

Organization permissions

Below the access blocks is a separate Organization permissions checklist - the five company-level capabilities. These apply everywhere regardless of the workspace scope above, so they're granted directly here rather than through a role.

The member's permissions take effect within 60 seconds.

Custom permissions are per-member

A custom permission set is saved on the member, not as a shared role. Editing it later changes only that member - it does not create or modify any role that others use.

API key permissions

API key permissions are a separate system from member access. When creating an API key, you assign it specific permissions that govern what it can access programmatically. Member roles control whether someone can manage API keys (api_keys:read/write/delete) within a workspace, but the API key's own permissions are independent.

---

Teams

Teams provide tag-based resource scoping within a workspace. While roles control what actions a member can perform, teams control which resources they can see - and a team carries its own role and workspace scope.

How teams work

• Each team has a role and a workspace scope, plus an optional set of tags (e.g., marketing, europe, premium)
• Resources (campaigns, journeys, segments, templates) can be tagged
• Team members can only see resources that share at least one tag with their team
• Untagged resources are visible to everyone
• Members with no team assignment see all resources (backward compatible)
• Team scoping is a narrowing filter - it can only restrict, never widen access

Creating a team

1. Go to Settings → Team & Access → Teams
2. Click Create Team
3. Enter a name and description, pick the team's role and workspace scope
4. Add tags that define which resources this team can access - picked from your existing workspace tags
5. Click Save

Managing team members

1. Go to Settings → Team & Access → Teams
2. Open a team and use the member picker to add people from your organization
3. Remove a member with the remove button

Example: regional teams

Team	Tags	Visible resources
EMEA Marketing	emea, marketing	Campaigns tagged with emea or marketing
US Sales	us, sales	Campaigns tagged with us or sales
Global Analytics	(no tags)	All resources (no restriction)

Tagging resources

To use team-based scoping, tag your resources. Tags can be added when creating or editing any of the following:

Campaigns

1. Go to Campaigns → Create or edit an existing campaign
2. In the Details tab, find the Tags section
3. Type a tag name and press Enter or click Add

Journeys

1. Go to Journeys → Create or edit an existing journey
2. In the creation form, find the Tags section after the description
3. Add tags the same way

Segments

1. Go to Segments → Create or edit an existing segment
2. Find the Tags section after the description

Email templates

1. Go to Templates → Email Templates → Create or edit an existing template
2. Find the Tags section after the description

In-app templates

1. Go to Templates → In-App Templates → Create or edit an existing template
2. Find the Tags section after the description

Tips

• Use consistent tag names across resources (e.g., always use emea not EMEA or Europe)
• A resource with no tags is visible to all team members
• A resource with tags is only visible to team members whose team shares at least one matching tag
• Tags are case-sensitive

Tag your campaigns, journeys, segments, and templates appropriately, and team members will only see what's relevant to them.