Permissions

Endpoints require permissions. A person or key gets permissions from its roles: exactly one base role, plus any number of duty roles.

Permissions

Permission	Allows
records.read	See records in the apps they can open
records.write	Create and change records
apps.configure	Configure apps (document types, checks, policies)
processes.read	See processes and runs
processes.run	Start and cancel process runs
processes.edit	Install, edit and turn processes on or off
processes.promote	Raise a process's autonomy or its automated share
tasks.work	Work on assigned tasks
approvals.decide	Approve or reject AI actions
connections.manage	Connect mailboxes and other apps
billing.manage	Billing settings, products, voiding and marking invoices paid
payments.refund	Refund payments
members.read	See who is in the workspace
members.manage	Invite, suspend and remove people
roles.grant	Change people's roles and app access
security.manage	Security settings, single sign-on, sessions
api_keys.manage	Create and revoke API keys
audit.read	Read and export the audit log
changes.approve	Approve other people's changes (four-eyes)
workspace.manage	Rename the workspace
workspace.transfer	Grant or remove the owner role
usecases.read	Browse the use-case catalog and the workspace's use cases
usecases.manage	Set the workspace's tags, take up use cases, set their status and owner

Roles

Role	Kind	Permissions
Owner	base	all
Admin	base	all except workspace.transfer
Member	base	records.read, records.write, processes.read, processes.run, tasks.work, members.read, usecases.read
Viewer	base	records.read, processes.read, members.read, usecases.read
Guest	base	records.read, records.write, tasks.work — only in the apps they're given
Approver	duty	approvals.decide
Finance	duty	billing.manage, payments.refund, approvals.decide
Process owner	duty	processes.edit, processes.run, apps.configure, usecases.read, usecases.manage
Risk officer	duty	changes.approve, processes.promote, approvals.decide, audit.read
Auditor	duty	audit.read, records.read, processes.read, members.read, usecases.read

API keys may hold viewer, member, process_owner, finance and approver — never owner, admin or risk officer.

App routes

Inside an app's API (for example /v1/crm/…), reading (GET) needs records.read and anything else needs records.write, on top of the app being enabled for the workspace and allowed for the token.

Separation of duties

Some rules hold whatever the permissions:

• Nobody can approve their own change.
• Whoever built the current version of a process can't approve raising its autonomy or automated share.
• With four-eyes on, changes that widen what can happen without a person (more automation, looser controls, new privileged roles, turning on an API key) wait for a second person. The API answers 202 Accepted with the pending change request. Narrowing changes apply at once.