Create, edit and delete custom roles
A custom role is a role you build from a list of permissions when the built-in roles don't fit. You make it in Workspace Settings → Roles & Permissions → New Role. Custom roles are included on the Pro plan, and during a Pro trial (New Role shows a Trial pill).
Who can build custom roles
Workspace Owners, and anyone whose workspace role includes Manage custom roles (workspace and project), can build workspace and project roles. A Workspace Owner can grant any permission; anyone else only the ones their own role has, and the rest are greyed out with "You can't grant this permission because your own role doesn't have it."
Custom roles belong to the workspace, so a custom project role can be given to anyone in any project of that workspace. Mammoth enforces them on the server like built-in roles. On a plan without custom roles, New Role shows the upgrade prompt described in When a feature isn't on your plan.
Create a custom role
- In Workspace Settings → Roles & Permissions, click New Role (top right). The Create role panel opens.
- Choose Workspace or Project at the top. Switching scope clears the permissions you've ticked.
- Enter a Name, for example Sales reviewer.
- Check the description. By default it's an Auto-generated description built from your ticks, for example "Manage the Data Library. View connections." Click Write my own to write one; Use auto switches back.
- Under Select permissions, tick what the role should have. A section's box ticks every permission in it. The counter shows how many you've picked out of the total.
- Click Create Role.
Mammoth shows "Role created", and the role appears as a column in the matrix, marked Custom. Create Role stays disabled until the role has a name and at least one permission; hover it to see why, for example "Enter a name and select at least one permission." A name already used in the same scope, including a built-in name such as Owner or Admin, shows "This name is already in use. Choose another."
Workspace permissions you can pick
| Section | Permissions (as shown) |
|---|---|
| General | Modify name, logo, etc., Delete Workspace |
| Users | Add external users to Workspace, Change user roles and manage invitations, Remove users, View workspace users |
| Subscription | Add/modify payment settings, Change subscription plan (upgrade/downgrade), Manage Connectors (add/remove/assign to Projects), View subscription plan, Delete subscription plan. Shown only on self-serve plans |
| Governance | Manage API Tokens (create/revoke), View Activity Log, Export Activity Log, Manage custom roles (workspace and project) |
| Projects | View all Project names (even without access), Assign user access to Projects they're not part of, Create a new Project, Delete any Project (even without access) |
Every custom workspace role can also open the workspace, and every custom project role the project it's given on, whatever you tick.
Project permissions you can pick
| Section | Permissions (as shown) |
|---|---|
| Project Settings | Edit project settings, Delete project |
| Team | Add people to this project, Change a member's role, Remove people from this project |
| Data Library | Manage items (add/modify/delete), View items in Data Library, Download datasets and views, Configure export destinations, Execute exports / sync |
| Connections | Create/update/delete connections, Create/update/delete queries, View connections and queries |
| Workflows | Create/edit/delete workflows, View workflows (read-only), Run and rerun views, Manage execution controls (Draft Mode, Auto-Sync), Manage Parameters and Snippets, Manage Workflow Monitor (release pending items) |
| Orchestration & Approvals | Create/manage orchestration flows, Monitor orchestration status, Approve/reject Checkpoint gates |
Permissions that tick another permission
Ticking a permission also ticks the read permission it needs. Unticking the needed permission unticks the ones that rely on it.
| When you tick | Mammoth also ticks |
|---|---|
| Manage items (add/modify/delete), Execute exports / sync, Run and rerun views, Manage execution controls (Draft Mode, Auto-Sync), Manage Parameters and Snippets | View items in Data Library |
| Configure export destinations | View items in Data Library and Download datasets and views |
| Create/update/delete connections, Create/update/delete queries | View connections and queries |
| Create/manage orchestration flows | Monitor orchestration status |
| Add external users to Workspace, Change user roles and manage invitations, Remove users | View workspace users |
| Export Activity Log | View Activity Log |
| Add/modify payment settings, Change subscription plan (upgrade/downgrade), Delete subscription plan | View subscription plan |
| Assign user access to Projects they're not part of | View all Project names (even without access) |
Edit a custom role
- In Roles & Permissions, click Edit on the role's column.
- In Edit role, change the name, description or permissions.
- Click Save Changes. Mammoth shows "Changes saved".
The change applies to everyone who holds the role. Built-in roles have no Edit link and can't be changed. Closing with unsaved changes opens Discard changes?: "You have unsaved changes to this role. Discard them?" Click Discard or Keep editing.
Give someone a custom role
Custom roles appear in the same role pickers as the built-in roles, listed after them with their description.
| Role type | Where you assign it |
|---|---|
| Custom workspace role | The role menu at the top of a user's side panel in User Management, and the role selector in Existing workspace users in the Invite users to workspace dialog |
| Custom project role | The project role dropdown next to each project in a user's side panel, the project's Manage Users list, and the user list in Project Settings |
Workspace Owners can assign any role. Anyone else can only assign a custom role whose permissions their own role has. Other custom roles are greyed out with "You can't assign this role because it has permissions your own role doesn't have."
Delete a custom role
- In Roles & Permissions, click Edit on the role.
- Click Delete Role.
- In the dialog, for example Delete "Sales reviewer"?, click Delete role.
Mammoth shows "Role deleted". Deleting a role is permanent.
Limits
| Item | Limit |
|---|---|
| Custom role name | 40 characters, unique in its scope (capitals ignored) |
| Custom role description | 120 characters |
| Number of custom roles | No limit |
Troubleshooting custom roles
| Symptom | Cause | Fix |
|---|---|---|
| "This role cannot be deleted while it has 3 user(s) assigned. Reassign or remove them first." (only Close offered) | People still hold the role | Click the role's user count in the matrix to see who, give them another role, then delete |
| "Failed to delete role. Please try again." | A pending invitation names the role | Cancel the invitation first |
| "Failed to save role. Please try again." when renaming | A pending invitation names the role | Cancel the invitation first |
| A permission is greyed out | Your own role lacks it | Ask a Workspace Owner |
Related
- Roles and permissions: what the built-in roles can do, and how to read the matrix.
- Invite members: change someone's workspace or project role.
- Share a project and set project roles: roles from inside a project.
- Audit logs: who changed what.
Something wrong? support@mammoth.io