Permissions
Every permission an Endless workspace enforces, what each one lets someone do, and which of the four roles holds it by default, in one table.
Endless checks eleven permissions before it allows an action, and a person's role decides which they hold. This table is generated from the permission catalog, so it matches what the product enforces.
| Permission | What it lets someone do | Admin | Billing manager | Member | Viewer |
|---|---|---|---|---|---|
| View and manage billing | See invoices and payment details, change the plan, and buy credit packs. | Yes | Yes | No | No |
| Invite and remove members | Send and revoke invitations, remove people, set their spending limits, and manage team membership. | Yes | No | No | No |
| Manage roles and permissions | Change which role each person holds and, where custom roles are on, what each role can do. | Yes | No | No | No |
| Change workspace settings | Rename the workspace, change its logo and URL, manage teams, and delete it. | Yes | No | No | No |
| Create and edit content | Chat, generate images and video, create or edit canvases, projects, skills, transcripts and connectors, and edit what's shared with them as Can edit. | Yes | No | Yes | No |
| Delete own content | Trash, restore, and permanently delete their own work. | Yes | No | Yes | No |
| Read content created by others | Open other people's private scheduled tasks and their run history. Nothing else that's private. | Yes | No | No | No |
| Edit content created by others | Change someone else's projects, skills and scheduled tasks they can open, plus connectors and published sites. Never chats, canvases or assets, and never who has access. | Yes | No | No | No |
| Delete content created by others | Delete the same. | Yes | No | No | No |
| View workspace activity and governance | See the whole workspace's activity, and which models, features and tools each person can use — without changing any of it. | Yes | No | No | No |
| Change workspace governance settings | Turn models, features and tools on or off for the workspace, a team or one person, and change credit alert rules. | Yes | No | No | No |
Rules
- Defaults: every workspace starts with these. Where custom roles are on, an admin can change them for Member, Billing manager and Viewer.
- Admin holds everything and can't be narrowed. Only an admin can grant or remove Admin, and the last admin can't be demoted or removed.
- Viewing governance and changing it are separate permissions, so someone can review settings without changing them.
- Editing and deleting others' work are separate permissions. They reach only projects, skills and scheduled tasks the holder can open, plus connectors and published sites. Chats, canvases and assets follow sharing instead.
Roles are assigned per person in Settings → Members. The reasoning behind each permission, and what each role sees, is in Roles and permissions.