How Permissions Work
Access control is built on roles and policies. This combination allows for flexible and granular control over user permissions.- Roles: A role is a collection of permissions that you can assign to users. We provide system roles with pre-defined permissions, and you can also create custom roles.
- Policies: A policy defines a specific permission. It consists of an action (like “read” or “create”) and a resource (like “Jobs” or “Candidates”). Each policy either allows or denies the action on the resource.
- Resources: These are the different areas of the platform you can control access to, such as Jobs, Candidates, and Settings.
- Actions: These are the operations a user can perform on a resource, like creating, reading, editing, or deleting.
Core Concepts
Available Actions
You can grant users the ability to perform the following actions on different resources:- Create: Add new items, such as creating a new job.
- Read: View information, such as looking at a list of candidates or opening a job.
- Update: Edit existing items, such as changing a job’s settings.
- Delete: Remove items, such as deleting a job.
- Manage: Full permission to perform all actions on a resource.
Available Resources and Permissions
You can set permissions for the following resources. Note that not all actions are available for every resource.
Decisions control the official application decision (Shortlisted, Rejected, Submitted, Placed, Hired, and any custom decision types). Can read lets a user see decisions. Can set lets them change the official decision.
Users without Can set who only see sessions shared with them (the Evaluator system role) can still record their own evaluator opinion — Shortlisted, Rejected, or No decision — on those shared sessions. That opinion does not overwrite the official decision.
Candidates: Can edit gates candidate file upload, rename, and delete, phone-number reset, and ATS external-id writes.
Analytics is the company Analytics page (
/analytics). It is separate from the Analytics tab on an individual job (see Additional Job-Level Permissions below).
Additional Job-Level Permissions
For the Jobs resource, you can grant these additional permissions:- Can access settings tab
- Can access interview guides tab
- Can access analytics tab
Additional Workflow-Level Permissions
For the Workflows resource, you can grant this additional permission:- Can edit email configuration
System Roles
We provide three default system roles to get you started. System roles are shared across every company and cannot be edited or deleted from the dashboard.- Admin: Full access on every resource, including Integrations, Users, Analytics, and Global Settings.
- Recruiter: Full access to jobs (including all sub-tabs), sessions, official decisions, candidates, templates, interview guides, Talent Match (including configuring match queries), and the dashboard. Read-only on workflows, with the ability to edit email configuration. No access to integrations, users, the Analytics page, or global settings.
- Evaluator: Read-only access to jobs and sessions that have been explicitly shared with them, including the job settings, interview guides, and analytics tabs. They can view official decisions and record their own evaluator opinion (Shortlisted, Rejected, or No decision) on shared sessions. They cannot change official decisions or access other areas of the platform.
Custom Roles
For more specific needs, you can create your own roles with tailored permissions.Create a Custom Role
- Navigate to Settings > Team and select the Roles and Permissions tab.
- Click Create a Role.
- Enter a descriptive Role Name (e.g., “Regional Manager”).
- If your organization has more than one company, choose which Companies the role applies to, or select All Companies.
- Select which permissions to grant for each resource (Dashboard, Jobs, etc.) by checking the corresponding boxes.
- Click Create Role to save.
Default Role for Auto-Imported Users
On the same Roles and Permissions tab, you can set the Default role for auto-imported users. Users created automatically — via SSO or imported as job owners from your ATS — are assigned this role. The default is Recruiter.Conditional Policies
You can add conditions to policies to restrict access based on specific criteria. This is useful for roles that should only manage a subset of jobs or candidates. When editing a role, you can set conditions on: Jobs- Label: Restrict access to jobs with specific labels. Conditions match on the label itself, so renaming a label later does not drop access.
- Created by: Limit access to jobs created by specific users, or choose self for the user’s own jobs.
- Job label: Restrict which interview sessions a user can see, based on the labels of the job those sessions belong to. A Jobs label condition does not automatically apply to Sessions — set this separately if the role should only see candidates on labeled jobs.
How Permissions are Evaluated
When a user tries to perform an action, the system checks permissions in the following order:- Admin Check: The system first checks if the user has an Admin role with full access. If so, the action is allowed.
- Policy Evaluation: If the user is not an Admin, the system evaluates all policies assigned to their role. If an “allow” policy matches the action, it is permitted. However, a “deny” policy will always override an “allow” policy.
- Default Deny: If no policies specifically allow the action, it is denied by default.
Managing Roles
You can create, edit, and assign roles from the Team settings page.- Navigate to Settings > Team.
- Select the Roles and Permissions tab to view, create, or edit roles. System roles are listed first and marked as system.
- Select the Team Members tab to assign roles to your users. Find the user in the list and select the desired role from the dropdown menu in the “Role” column.