Sharing & Permissions

Access in Rollout has two layers: a workspace role that controls what you can administer, and per-item sharing that controls who can see and edit each Project, Document, Workflow, or other resource. Items start private to their owner and are shared deliberately.

Workspace roles

Every member of a workspace holds one role:

Admins and the owner can open every team and every item shared with a team or the whole workspace. Nobody — including admins — can open another person's private items.

Managing members

Admins manage membership on the Members page in Settings:

• Invite member sends an email invitation with a workspace role of Member or Admin. Team membership is managed separately on team pages.
• Switch a member between Member and Admin with the role selector. The workspace owner's role can't be changed here.
• Suspend removes a member's access immediately; Activate brings them back. Remove takes them out of the workspace.
• Pending invites can be re-sent or revoked.
• At least one active admin must remain, and you can't demote yourself if you're the last one.

Settings access by role

• All members: workspace resources they are allowed to use, plus read-only General, Billing usage, and Execution & network views.
• Admins: Members, Teams, Billing, Trash, Objects, Shared fields, Labels, Policies and the Audit log, plus workspace and security-policy editing.
• Owner: the Danger zone inside General. Deleting the workspace also requires a recent sign-in.

The cross-workspace Operator console is reserved for explicitly allowlisted Rollout operators; workspace Admin or Owner status does not grant access.

Item visibility

Every shareable item has an owner and one of three visibility levels:

• Private — only the owner. The default for new items.
• Team — shared with one or more teams. What a teammate can do depends on their role in that team.
• Workspace — everyone in the workspace can view it. Editing still requires being the item's owner or a workspace admin.

Not every item supports every level:

Where to change sharing

• Projects and Objectives: the access selector in the create/edit form.
• Documents: the details sidebar on the document page, which also shows the owner.
• Workflows: the workflow settings sidebar in the editor.
• Records: records inherit access from their object. Set Records access on the object page under Settings › Objects; sharing with a team applies to every record of that type.
• Feed posts: choose Who can see this? when sharing a post.

Changing an item's sharing or owner requires manage access: you must be its owner, a workspace admin (for non-private items), or an admin of a team the item is shared with.

Items that follow their container

Some items have no sharing controls of their own — they follow the item that contains them:

• Tasks follow their Project. A Task with no Project is personal: only its creator sees it.
• Milestones follow their Project.
• Key results follow their Objective.
• Records follow their object.

Team roles

Sharing with a team grants access based on each person's role in that team:

Teams can be nested. Membership in a parent team carries down, so someone on a parent team has the same access to items shared with its sub-teams. Workspace admins can create top-level teams; team admins can create sub-teams under teams they manage.

See Projects, Tasks & Teams for creating teams and managing their members. Teams may not be enabled in every workspace yet.

Sharing operational resources

Connections, secrets, devices, and agent identities use the same private / team / workspace model with stricter rules, because they carry credentials and capabilities:

• Each is private to its owner until shared. Share them from Settings, such as Connections and Secrets.
• Sharing with a team lets that team (and parent teams) use the resource; sharing with the workspace lets everyone use it.
• Workspace admins get no implicit access: an admin can manage one of these resources only after it is shared with the whole workspace. Team-shared resources are managed by their owner or that team's admins.
• Transferring ownership is limited to the current owner, or a workspace admin once the resource is workspace-shared.

See Security for how credentials and secret values are protected.

Archived resources and restoring

Archiving hides an item without deleting it: each list's Archived view shows archived items with a Restore action. Deleting a Workflow, Project, Task, Document, Objective or Template moves it to Trash for 30 days, then it is permanently deleted (a Workflow with its run history; a Project's Tasks are kept as archived Tasks without a project). Apps and Pages can only be archived:

• Each Trash row shows when the item was archived and when it will be permanently deleted. Delete now removes an item early.
• Restore brings an item back exactly as it was. Workflows keep their Runs until they are purged, and a restored Workflow's Triggers re-arm only if the Workflow is enabled.
• Archived labels, objects and shared fields are restored from their own settings pages (Labels, Objects, Shared fields) instead.
• Archived secrets can't be restored, and deleting a Connection is permanent.

Troubleshooting

A teammate can't see something you shared

• Check the item's visibility — private items are visible only to their owner.
• For team-shared items, confirm they are an active member of that team or one of its parent teams.
• Suspended members lose access immediately, even to items shared with them.

You can't change an item's sharing

• Only the owner, a workspace admin (for non-private items), or an admin of a team the item is shared with can manage access.

An item disappeared

• It may have been archived: check the list's Archived view. A deleted Workflow, Project, Task, Document, Objective or Template stays in Trash for 30 days.