Permission Matrix

How to read this matrix

This matrix shows what every role in Lifesight can open and change, module by module. Use it to check what a teammate will be able to do before you invite them or change their role, to spot where a preset role falls short and a custom role is needed, or to understand why a module shows Access Restricted for someone on your team.

Every cell in the tables below uses one of three symbols, so once you know them you can read any table on this page at a glance.

Legend: ● Manage (full) · ◐ Read · ○ No access (grayed out in the sidebar, opens Access Restricted)

In the per-module tables, each symbol matches a value in the source grid:

● is F: the role can read and has full access.
◐ is R: the role can read only.
○ is N: the role has neither.

In the module-level table, the symbols summarize the whole module:

● means the role holds Manage access on at least one non-action sub-module.
◐ means the module opens, but without Manage access.
○ means the module does not open at all.

Role columns in the per-module tables are abbreviated to save space. The table below maps each abbreviation to its full role name and its role key.

Two rules turn a cell into behaviour, and both are evaluated in the browser as the
page renders.

Settings, Team, and Support open for every role. Only the buttons inside them are limited by role. Support is always open. Settings and Team open because every role includes read access to notification preferences and to the team member list. A custom or unrecognized role with no rights set up still opens both. That is why Settings and Team still appear as rows in the tables below.

This page describes rights, not people. Your session carries the role it was given when you signed in, based on the email address you signed in with, and that role does not change until you sign in again. See Sign in, stay signed in, and log out.

Roles

Six roles ship built in. The lookup key is the role name as the product writes it.

Lifesight has 55 rights in total. Each of the 16 modules has a Read access right and a Manage access right, and each of the 23 actions has one right of its own. When you select a role on Manage Roles, the detail panel shows how many rights it holds, as a number labeled permissions. Viewer does not appear on Manage Roles or in the Invite User role list, so its count of 16 comes from the same grid rather than from a screen.

Viewer and Executive both hold 16 rights, but not the same 16. Viewer can read all 16 modules and holds no action rights. Executive opens four fewer modules and holds three action rights.

Older role names map to current ones. admin becomes WorkspaceAdmin, analyst becomes Data Practitioner, executive becomes Executive, and viewer becomes Viewer.

Module access by role

Every Lifesight module appears here, one per row, so you can check what each role can open or manage, including modules that don't have their own article in this guide.

Legend: ● Manage (full) · ◐ Read · ○ No access (greyed sidebar, Access Restricted)

A ○ cell is what sends someone to Access Restricted, where they can select Request Access. See

Ask for access, and review requests.

Marketing Scientist can open Data without Read access on it. Two of the action rights the role holds include read, so the module opens, and the table shows ◐. Every other part of Data stays ○ for that role.

Sub-modules and action rights by role

The tables below go module by module, in the same order the modules appear on Manage Roles. Within each table, the module's regular rights come first, followed by its action rights.

Rows marked · action are action rights. Each one controls a specific button in the product. The key on each action row is the same right code used in the agent cards across these pages.

Legend: ● F full access · ◐ R read only · ○ N no access. On a · action row, ● means the button works for that role, and both ◐ and ○ mean it does not.

Cockpit · Plan · Deploy · Attribution · Creative · Models · Experiments · Data · Config · Artifacts · Team · Settings

Cockpit

Manage Roles groups Cockpit under Platform. The module page is /cockpit and it carries 1 action right.

Plan

Manage Roles groups Plan under Action. The module page is /planning, and it carries 2 action rights.

Deploy

Manage Roles groups Deploy under Action. The module page is /decisions, and it carries 3 action rights.

Attribution

Manage Roles groups Attribution under Intelligence. The module page is /attribution, and it carries 2 action rights.

Creative

Manage Roles groups Creative under Intelligence. The module page is creativesand it carries no action rights.

Models

Manage Roles groups Models under Causality. The module page is /models, and it carries 3 action rights.

Experiments

Manage Roles groups Experiments under Causality. The module page is /experiments, and it carries 1 action right.

Data

Manage Roles groups Data under System. The module page is /data and it carries 4 action rights.

Config

Manage Roles groups Config under System. The module page is /config and it carries no action rights.

Artifacts

Manage Roles groups Artifacts under Artifacts. The module page is /artifacts and it carries no action rights.

Team

Manage Roles groups Team under Workspace. The module page is /teamand it carries 4 action rights.

Team opens for every role at View team members. The four action rights are what separate a Workspace Admin from everyone else.

Settings

Manage Roles groups Settings under Workspace. The module page is /settings, and it carries 3 action rights.

Notification preferences is the one Settings sub-module every role can change, which is why Settings reads ● for five of the six roles.

Custom roles

The tables on this page cover the six built-in roles only, not custom roles. A custom role is built from the same 55 rights, but the rights it holds are saved in your browser rather than in the tables here. There are two ways a custom role gets created.

How a generated role gets its name. When an access request is approved, the new role is named after the role the person already holds, followed by each module they were granted, joined by +. For example, Executive granted Data becomes Executive + Data. A second approval for the same person extends that name, as in Executive + Data + Config. A Workspace Admin never gets a generated role, because they already have access to everything.

A generated role may not match this page exactly. The modules it carries over from the person's original role come from a separate, older list of role access, not from the tables on this page, so the two can differ.

Custom roles and action buttons. Treat any role not listed in the table above as holding none of the rights on this page. In this build, action buttons are never enabled for a custom role, so every action right is denied for it. Building one is on Create a custom role.

---

Frequently Asked Questions

What do the symbols in the tables mean?
● means Manage (full access), ◐ means Read only, and ○ means no access. A ○ module is grayed out in the sidebar and opens Access Restricted.

On an action row, what does ◐ mean?
The button does not work. On a row marked · action, only ● means the button works. Both ◐ and ○ mean it does not.

How many rights does Lifesight have in total?
55: a Read access right and a Manage access right for each of the 16 modules, plus one right for each of the 23 actions.

Why does a module open for a role that has no Read access on it?
A module opens when at least one of its sub-modules carries read, and action rights include read. For example, Marketing Scientist can open Data because two of its action rights carry read, even though every other part of Data stays ○ for that role.

Why do Settings, Team, and Support open for every role?
Support is always open. Settings and Team open because every role includes read access to notification preferences and to the team member list. Only the buttons inside them are limited by role.

Viewer and Executive both hold 16 rights. Are they the same?
No. Viewer can read all 16 modules and holds no action rights. Executive opens four fewer modules but holds three action rights.

Why doesn't Viewer appear in Manage Roles or the Invite User list?
Viewer is a built-in role that isn't offered in those lists. Its count of 16 rights comes from the permissions grid rather than from a screen.

What happens when someone hits a ○ module?
They see Access Restricted, where they can select Request Access. See Ask for access, and review requests.

Are custom roles covered on this page?
No. This page covers the six built-in roles only. A custom role is built from the same 55 rights, but the rights it holds are saved in your browser rather than in these tables.

Why doesn't my custom role match this page?
A role generated by approving an access request carries over modules from a separate, older list of role access rather than from these tables, so the two can differ.

Do action buttons work for a custom role?
In the current release, action buttons are never enabled for a custom role, so every action right is denied for it. See Create a custom role.

I was given a new role but nothing changed. Why?
Your session carries the role it was given when you signed in, based on the email address you signed in with. That role doesn't change until you sign in again. See Sign in, stay signed in, and log out.

What do the older role names map to?
admin becomes WorkspaceAdmin, analyst becomes DataPractitioner, executive becomes Executive, and viewer becomes Viewer.

Related