# Permissions > Every permission an Endless workspace enforces, what each one lets someone do, and which of the four roles holds it by default, in one table. Source: https://endless.okinawa/docs/reference/permissions Endless checks eleven permissions before it allows an action, and a person's role decides which they hold. This table is generated from the permission catalog, so it matches what the product enforces. ## Rules * **Defaults:** every workspace starts with these. Where custom roles are on, an admin can change them for Member, Billing manager and Viewer. * **Admin holds everything** and can't be narrowed. Only an admin can grant or remove Admin, and the last admin can't be demoted or removed. * **Viewing governance and changing it are separate permissions**, so someone can review settings without changing them. * **Editing and deleting others' work are separate permissions.** They reach only projects, skills and scheduled tasks the holder can open, plus connectors and published sites. Chats, canvases and [assets](/docs/concepts/assets-and-visibility) follow sharing instead. Roles are assigned per person in **Settings → Members**. The reasoning behind each permission, and what each role sees, is in [Roles and permissions](/docs/governance/roles-and-permissions).