Roles & Permissions

This page explains what each user role can do in Arketic AI, so you can give every team member exactly the access they need — and nothing more.

Every person has one primary role, chosen from four built-in system roles. On top of it you can give a person up to four additional roles — custom roles you build yourself. Together, a person's roles decide which parts of Arketic they see in the sidebar and what they are allowed to do once they get there.

---

The System Roles

There are four system roles. You pick one as the primary role when you invite someone or edit their profile.

Role	Best for	What they can do
Member	Regular employees	Chat with assistants, manage their own tasks and personal documents, and join projects
Executive	Leadership and senior managers	An organization-wide overview: dashboard, analytics, and the org chart — plus everything a Member can do
Admin	Platform managers	Everything — users, departments, assistants, models, knowledge base, workflows, prompts, analytics, and settings
Restricted	Accounts that should start with nothing — onboarding, contractors, an account under review	No access by default. Everything they can reach comes from the custom roles you add — see The Restricted role

:::info Department managers aren't a separate role "Manager" is not a role you assign here. Any Member who is set as the manager of a department automatically gains extra abilities for that department. You set a manager on the department itself, not on the person's role — see Departments. :::

---

What each role can access

The table below shows what each system role reaches by default. A custom role given to a person as an additional role can add to it — so someone who is a Member can still have, for example, Prompts or Workflows.

Feature	Member	Member (department manager)	Executive	Admin
AI Chat	✅	✅	✅	✅
Projects	✅	✅	✅	✅
My Documents	✅	✅	✅	✅
Assistants (browse & use)	✅	✅	✅	✅
Tasks (own)	✅	✅	✅	✅
Tasks (team)	❌	✅	✅	✅
Epics (manage)	❌	✅	✅	✅
Blueprints	❌	✅*	✅	✅
Knowledge Base	via assistants	✅*	✅	✅
Dashboard	❌	❌	✅	✅
Analytics	❌	❌	✅	✅
Org Chart	❌	❌	✅ (no position changes)	✅
Departments & Users	❌	❌	❌	✅
AI Assistants (config)	❌	❌	❌	✅
Models & Providers	❌	❌	❌	✅
Workflows	❌	❌	❌	✅
Prompts	❌	❌	❌	✅

* For a Member who manages a top-level department.

note

Members, Executives and Admins can all use AI Chat, browse and use assistants, work in Projects, keep personal files in My Documents, and manage their own tasks. The exception is Restricted, which starts with none of these.

:::info Tasks and Blueprints depend on your package If your organization's package doesn't include Tasks and Blueprints, those two items disappear from the sidebar for everyone — Admins included. Opening them shows "This module isn't in your package". Contact your account manager to have it enabled. :::

---

Role descriptions

Member

The standard role for most employees. A Member can:

• Chat with the assistants they have access to.
• Manage their own tasks and keep personal files in My Documents.
• Join and work in Projects.
• Browse and use assistants.

A Member reaches knowledge base content through assistants (when an assistant has a knowledge base connected) rather than opening the Knowledge Base area directly.

Member set as a department manager

When a Member is made the manager of a department, they keep everything a Member can do and also gain, for that department:

• Team tasks — see and manage the tasks across their team, not just their own.
• Epics — create, edit, and organize epics.
• Incoming service requests — pick up and handle requests routed to their department.

A Member who manages a top-level department also gets two more items in the sidebar:

• Blueprints — build and run repeatable process templates.
• Knowledge Base — open and manage the department's knowledge base directly.

You assign a manager from the department, not from the user's role. See Departments.

Executive

Best for leadership who need visibility without day-to-day administration. An Executive gets:

• The Dashboard and Analytics for an organization-wide view.
• The Org Chart — they can see the whole structure and fill in Role Definition Cards and Person Cards, but can't create or change positions, departments or users.
• Team tasks, epics, and blueprints.
• The full shared workspace (chat, projects, tasks, documents, assistants).

An Executive does not manage users or departments, configure assistants, set up models and providers, build workflows, or manage prompts. Those stay with Admins.

Admin

Full control of the platform for your organization. An Admin can do everything above, plus:

• Invite, edit, and manage users and their roles.
• Create and organize departments and the org chart.
• Configure AI Assistants and set up Models & Providers.
• Manage the Knowledge Base, Workflows, and Prompt templates.
• View Analytics.

Settings and Help & Support are not tied to a role — every role has them at the bottom of the sidebar.

---

The Restricted Role

Some organizations want a new account to start with no access to anything until it's deliberately given some — for onboarding, contractors, or an account under review. That is what Restricted is for.

A person whose only role is Restricted can sign in, but:

• The sidebar has no New Chat, no menu items and no recent conversations — only Settings, Help & Support and their user card.
• The main area shows "You don't have access to any features yet" and "Contact your administrator to get access."
• They can still open their own Profile to change their name, photo and password.

To give a Restricted person access, add one or more custom roles to them (below). They then see exactly the areas those roles allow, and nothing else. To give them a standard set of access instead, change their primary role to Member, Executive or Admin.

---

Custom Roles

If the system roles don't quite fit a situation — for example, someone who should be able to manage Prompts but nothing else an Admin can do — you can build a custom role with exactly the capabilities it needs.

1. Go to Settings → Roles & Permissions.
2. Click New role.
3. Give it a name and, optionally, a description.
4. Choose a starting point: Start from scratch (nothing enabled) or copy an existing role's permissions as a base.
5. Turn individual capabilities on or off, organized by area (Workspace, Platform, Organization, General).
6. Click Create role, then give it to people as an additional role (see below).

Every part of that screen is described in The Roles Screen below.

Custom roles appear in the role list alongside the system roles, each marked System or Custom so you can tell them apart. The four system roles can't be edited or deleted, but you can create as many custom roles as your organization needs.

:::tip A custom role only grants capability, not extra reach Giving someone a custom role can let them, say, create tasks — but it doesn't by itself widen whose tasks they can see. Broader visibility (an entire department, or the whole organization) still comes from being an Executive/Admin, or from being set as a department's manager. :::

Giving Someone an Additional Role

Everyone has one primary role, and you can grant up to four additional roles on top of it — useful when someone needs a narrow slice of extra access without changing their main role. Their effective access becomes the combination of every role they hold.

Only custom roles can be added as additional roles. A system role is always a person's primary role; to change it, see Assigning a Role below.

There are two places to do it:

• From the role — open the role in Settings → Roles & Permissions, click Manage next to Members, and add the person.
• From the person — open the person in Organization → Users and add the role under Additional roles.

:::caution Adding or removing a role signs the person out When you add or remove a role from someone, their current session ends and they'll need to sign in again for the change to take effect. :::

---

The Roles Screen

Roles are managed in Settings. Click Settings at the bottom of the sidebar, then, under the Administration group, open User Management → Roles & Permissions. The Users entry next to it takes you to the Users page.

By default this screen is open to Admins. Your organization can also give it to other people through a custom role — the whole screen, or only part of it, such as looking at roles without changing them. A control you aren't allowed to use is hidden or disabled.

The screen has two sides: the role list on the left, and the selected role's details, members and permissions on the right.

The role list

Element	What it does
New role	Opens the three-step Create role window
Search roles...	Filters the list by role name or description as you type
All / System / Custom	Shows every role, only the system roles, or only the custom roles
System roles and Custom roles	The two groups the list is divided into. Until you create a role, the second group reads "No custom roles yet."

Each row shows the role's name, a System or Custom badge, its description, and two small counters — how many permissions the role has and how many people hold it. Click a row to open that role on the right. When you arrive, the first role in the list is already open.

:::note How system roles are listed In this list the four system roles appear under their short names — admin, executive, member and restricted. They are the same roles shown as Admin, Executive, Member and Restricted everywhere else. :::

A role's details

The top of the right-hand side shows the role's name — with a System badge for a system role — and its description, or "No description".

A custom role has two icons next to its name:

Icon	What it does
Pencil	Lets you change the name and description in place. Click Save to keep the change, or Cancel to drop it
Trash	Deletes the role. The Delete role? dialog warns that the role "will be permanently deleted. This can't be undone." — click Delete to confirm. People who held the role lose the access it gave them

System roles have neither icon: they can't be renamed or deleted.

Under the name, one line shows how many permissions the role has, when it was created and when it was last updated — with the person's name when it is known, for example "Updated {date} by {name}".

Members

Next comes Members (n) — the number of people who hold the role, with their photos — and a Manage link. Manage opens the Members window for that role.

• The current members. A person for whom this is the primary role carries a Primary badge and can't be removed here; change their primary role on the Users page instead.
• Removing someone. Click the x next to any other member and confirm Remove member?.
• Adding someone. Under Add member, find the person with Search users... and click Add. Only active people who don't hold the role yet are listed.
• The limit. A person can hold at most four additional roles. Someone who already has four shows "Maximum of 4 additional roles" and their Add button is disabled.

For a system role the window lists the members but has no Add member part. It says why: "This is a system role. Its members come from each user's primary role, so they can't be added here — change the user's primary role instead."

caution

The window reminds you: "Adding or removing a member signs that user out — they'll need to sign in again."

Creating a role

Click New role. The Create role window has three steps; Next and Back move between them.

Step	What you do
Details	Enter a Role name (required) and, if you like, a Description. Two roles can't share a name — you'll see "A role with this name already exists"
Start from	Choose Start from scratch ("No permissions. Build them yourself."), or pick an existing role to copy its permissions. Both system and custom roles are offered
Permissions	Adjust what the role allows, on the same cards as in the permission matrix. A line at the top tells you how many permissions are selected

On the last step, click Create role. The new role opens on the right, ready to be given to people.

tip

When you start from scratch, the switch on a card selects every action in that area at once. Expand the card if you want to pick individual actions instead.

The permission matrix

Below the members, the role's permissions are laid out in four groups — Workspace, Platform, Organization and General. Each group heading shows how many of its areas are switched on, as n/m modules.

Every area of Arketic — Chat, Projects, Knowledge Base, Users and so on — has its own card:

Part of the card	What it does
Switch	Turns the area on or off for this role. Turning it on gives the basic "view" access; turning it off removes every action in the area
Counter	Shows how many of the area's actions are selected, as selected/total
Arrow	Expands the card so you can tick the specific actions the role may perform — creating, editing, deleting and so on

Some areas have no general "view" switch. Turning their switch on only opens the card, with the hint "No default view permission for this module — select the specific actions below to grant access." Tick the actions you want.

Nothing is saved while you tick. An Unsaved changes bar appears at the bottom of the screen: click Save Changes to apply your changes, or Discard to return to the saved state.

:::note System roles are read-only On a system role the cards are locked, and a line above them reads "System role — permissions are not editable." If you need a variation of a system role, create a custom role and pick that system role under Start from. :::

:::note Areas outside your package Areas that your organization's package doesn't include carry a Not in package label that names the missing module. They are locked and can't be switched on. :::

Leaving with unsaved changes

If you have unsaved permission changes and you open another role, start a new role, switch to another section of Settings or leave Settings, Arketic asks Discard unsaved changes? first. Choose Keep editing to stay and save, or Discard changes to drop them.

When a change is refused

Message	What it means
"This change would leave the organization without anyone who can manage roles"	Deleting this role, removing this member or switching off this permission would leave nobody able to manage roles. Give that ability to someone else first, then try again
"This role was changed by someone else, so your update was not applied. Your selections are kept — review them and save again."	Another person saved the same role while you were editing it. Check your selections and click Save Changes again

---

Assigning a Role

By default, only Admins can change a person's primary role.

1. Go to Organization → Users.
2. Click the user you want to change.
3. Under Role, choose Member, Executive, Admin, or Restricted.
4. Click Save Changes.

Custom roles are not in this list — add them under Additional roles in the same panel.

For the full walkthrough — including inviting new people and deactivating accounts — see User Management.

caution

The Admin role grants full access to all data and settings across your organization. Give it only to the people who genuinely need to manage the platform.

tip

Need someone to run a single department without handing them the whole platform? Keep them as a Member and set them as that department's manager instead of making them an Admin.