Roles & Permissions

Joryio provides a granular Role-Based Access Control (RBAC) system that lets you define exactly what each team member can do. You assign access from one place - Settings → Team & Access - using built-in roles, pre-built templates, custom permission sets, or team membership.

How access works

Every member's access is resolved from three things, unioned together:

1. Workspace grants - a role (or a custom permission set) applied to all workspaces or to specific workspaces. This is where most permissions live.
2. Team membership - teams carry their own role + workspace scope and narrow visibility by tags (see the Teams section below).
3. Organization permissions - a small set of org-wide capabilities granted directly to the member.

Permissions follow a resource:action format (e.g., campaigns:read, campaigns:send).

Workspace-level vs. company-level permissions

This is the most important concept in the model:

• Workspace-level permissions (the majority - campaigns, journeys, audience, content, data, events, analytics, integrations, API keys, settings, compliance, touching rules, WhatsApp) govern resources that belong to a single workspace. They are carried by role grants per workspace and by teams - never granted globally.

• Company-level (org-wide) permissions are the only capabilities that apply everywhere regardless of workspace. They are granted as a direct checklist on the member, not through a role and not scoped to a workspace. There are exactly five:

  Permission	What it allows
  team:read	View members and their roles
  team:write	Invite, update, and remove members
  team:manage_roles	Create, edit, and delete custom roles
  workspaces:manage	Create, delete, and configure workspaces
  org_settings:write	Modify org-wide configuration - email/SMS providers, general, tracking domain
  billing:read	View org-wide audit log, usage/spend breakdown, and wallet balance/ledger (spans all workspaces)

Everything not in that list is workspace-level. This split is why a member can be an admin in one workspace and have no access to another, while "manage members" or "manage workspaces" always applies across the whole organization.

Admins and owners

Admin and Owner bypass the resolver entirely - they always have every permission in every workspace. The split above matters for everyone else.

System roles

Admin has full access to every feature and setting, cannot be modified or deleted, and always reflects the current permission set - when a new permission is added to the platform, Admin gets it automatically. Owner is an alias of Admin.

Role	Description	Permissions
Admin / Owner	Full access to all features and settings	All permissions (always current)
Editor	Create and edit content; cannot delete, send, or manage settings/team/roles/API keys	Read + Write (no Delete, Send, settings:write, compliance:write, team:write, or api_keys:write)
Viewer	Read-only access to all data	All :read permissions

Template roles

Templates are pre-built starting points you can assign directly or clone and customize. Unlike Admin, a template is a fixed snapshot you maintain - it does not automatically gain new permissions when the platform adds them.

Template	Description	Key Permissions
Marketer	Create and send campaigns, manage audiences and templates	Campaigns (full), Journeys (full), Segments (read/write), Templates (read/write), Analytics (read), Users (read)
Developer	Manage integrations, events, and API keys	Events (read/write), Integrations (read/write), API Keys (read/write), Settings (read), Analytics (read)
Analyst	Read-only access to analytics, campaigns, and user data	Analytics (read), Campaigns (read), Journeys (read), Segments (read), Users (read), Events (read)

Permission categories

Permissions are organized into the following categories. Unless marked company-level, every category is workspace-level (granted per workspace through a role or custom set).

Campaigns

• campaigns:read - View campaigns and their statistics
• campaigns:write - Create and update campaigns
• campaigns:delete - Delete campaigns
• campaigns:send - Send, pause, resume, and cancel campaigns

Journeys (Canvas)

• canvas:read - View journeys and their executions
• canvas:write - Create and update journeys
• canvas:delete - Delete journeys
• canvas:activate - Activate, pause, and resume journeys

Users

• users:read - View user profiles and attributes
• users:write - Create and update user profiles
• users:delete - Delete user profiles
• pii:view - Reveal PII-flagged custom-attribute values in contact views (otherwise masked; admins and owners always have it)

Segments

• segments:read - View segments and their users
• segments:write - Create and update segments
• segments:delete - Delete segments

Templates

• templates:read - View email and in-app templates
• templates:write - Create and update templates
• templates:delete - Delete templates

Events

• events:read - Query event data and analytics
• events:write - Track events and user activities
• events:track - Ingest events via SDK and server endpoints

Entities

• entities:read - View custom entities and their records
• entities:write - Create and update custom entities and records

Analytics

• analytics:read - View analytics dashboards and reports
• analytics:write - Create and modify dashboards, funnels, cohorts, and saved queries

Settings (workspace)

• settings:read - View workspace settings
• settings:write - Modify workspace settings (monitoring, quiet hours, touching rules, subscriptions, apps & web push)
• settings:delete - Delete workspace settings resources

Integrations

• integrations:read - View configured integrations
• integrations:write - Configure and manage integrations

WhatsApp

• whatsapp:read - View WhatsApp Business accounts and templates
• whatsapp:write - Connect accounts and manage WhatsApp templates

Wallet

• wallet:read - View wallet pass accounts and issued passes
• wallet:write - Manage wallet credentials and issue/update passes

API Keys

• api_keys:read - View API keys (excluding secret values)
• api_keys:write - Create and update API keys
• api_keys:delete - Revoke and delete API keys

Compliance

• compliance:read - View compliance audit logs and DSR requests
• compliance:write - Process DSR requests and manage compliance settings

Touching Rules

• touching_rules:read - View frequency capping rules
• touching_rules:write - Configure frequency capping rules

Team Management - company-level

• team:read - View members and their roles
• team:write - Invite, update, and remove members
• team:manage_roles - Create, edit, and delete custom roles

Workspaces - company-level

• workspaces:manage - Create, delete, and configure workspaces

Organization Settings - company-level

• org_settings:write - Modify org-wide configuration (email/SMS providers, general, tracking domain)
• billing:read - View org-wide audit log, usage/spend breakdown, and wallet balance/ledger (company-level, spans all workspaces)

Creating a custom role

1. Go to Settings → Team & Access → Roles
2. Click Create Role
3. Enter a name and description
4. Optionally select a template to clone permissions from
5. Check or uncheck individual permissions grouped by category
6. Click Save

Assigning access to a member

All member management lives under Settings → Team & Access → Members. Click Invite member (for a new person) or edit an existing member. The form has two parts.

1. Who

Name, email, phone (with a country-code selector, stored in E.164), and Department. Department is a select box - choosing Agency / Third Party automatically marks the member as External (there's no separate checkbox).

2. Access

A member's access is the union of one or more blocks. Stack as many as you need with + Add access (top-right of the Access card) - each block is independently one of:

Block	What it means
Assign a role	Reuse a saved role (system, template, or custom).
Custom permissions	Build a one-off permission set just for this member.
Team access	The member inherits each selected team's role and workspaces.

Blocks combine freely - for example Marketer in Production + a custom set in Staging + membership in Team X, all on one member. For Assign a role and Custom permissions blocks you also pick the Workspace access - All workspaces or a specific set.

• Assign a role → pick the role from the card grid (name, description, permission count).
• Custom permissions → tick exactly the workspace-level permissions, grouped by category, with a live "n of m selected" count and Select all / Clear all.
• Team access → choose one or more teams; each brings its own role and workspaces.

Organization permissions

Below the access blocks is a separate Organization permissions checklist - the five company-level capabilities. These apply everywhere regardless of the workspace scope above, so they're granted directly here rather than through a role.

The member's permissions take effect within 60 seconds.

Custom permissions are per-member

A custom permission set is saved on the member, not as a shared role. Editing it later changes only that member - it does not create or modify any role that others use.

API key permissions

API key permissions are a separate system from member access. When creating an API key, you assign it specific permissions that govern what it can access programmatically. Member roles control whether someone can manage API keys (api_keys:read/write/delete) within a workspace, but the API key's own permissions are independent.

---

Teams

Teams provide tag-based resource scoping within a workspace. While roles control what actions a member can perform, teams control which resources they can see - and a team carries its own role and workspace scope.

How teams work

• Each team has a role and a workspace scope, plus an optional set of tags (e.g., marketing, europe, premium)
• Resources (campaigns, journeys, segments, templates) can be tagged
• Team members can only see resources that share at least one tag with their team
• Untagged resources are visible to everyone
• Members with no team assignment see all resources (backward compatible)
• Team scoping is a narrowing filter - it can only restrict, never widen access

Creating a team

1. Go to Settings → Team & Access → Teams
2. Click Create Team
3. Enter a name and description, pick the team's role and workspace scope
4. Add tags that define which resources this team can access - picked from your existing workspace tags
5. Click Save

Managing team members

1. Go to Settings → Team & Access → Teams
2. Open a team and use the member picker to add people from your organization
3. Remove a member with the remove button

Example: regional teams

Team	Tags	Visible resources
EMEA Marketing	emea, marketing	Campaigns tagged with emea or marketing
US Sales	us, sales	Campaigns tagged with us or sales
Global Analytics	(no tags)	All resources (no restriction)

Tagging resources

To use team-based scoping, tag your resources. Tags can be added when creating or editing any of the following:

Campaigns

1. Go to Campaigns → Create or edit an existing campaign
2. In the Details tab, find the Tags section
3. Type a tag name and press Enter or click Add

Journeys

1. Go to Journeys → Create or edit an existing journey
2. In the creation form, find the Tags section after the description
3. Add tags the same way

Segments

1. Go to Segments → Create or edit an existing segment
2. Find the Tags section after the description

Email templates

1. Go to Templates → Email Templates → Create or edit an existing template
2. Find the Tags section after the description

In-app templates

1. Go to Templates → In-App Templates → Create or edit an existing template
2. Find the Tags section after the description

Tips

• Use consistent tag names across resources (e.g., always use emea not EMEA or Europe)
• A resource with no tags is visible to all team members
• A resource with tags is only visible to team members whose team shares at least one matching tag
• Tags are case-sensitive

Tag your campaigns, journeys, segments, and templates appropriately, and team members will only see what's relevant to them.