Skip to main content
Tell uses a simple role-based access control (RBAC) system. Every user has a role in each workspace they belong to. Roles are hierarchical — higher roles inherit all permissions from lower ones.

​
Roles

​
Permissions

Roles map to four explicit permissions. View is implicit for all workspace members.

​
Common scenarios

Your analyst needs to build dashboards. Give them the Editor role. They can create boards and saved metrics, but can’t manage team members or run arbitrary SQL. A developer needs raw SQL access. They need the Admin role. Editors can use built-in metrics and boards, but raw SQL requires Admin. Your DevOps team manages the Tell deployment. Give them the Platform role on self-hosted installations. This allows cross-workspace operations like managing all workspaces and global settings.

​
Assigning roles

Roles are assigned when inviting users to a workspace:
Invitations expire after 7 days. The invited user must log in and accept the invite. Their email must match the invite.

​
Workspace-scoped roles

A user can have different roles in different workspaces. For example, you might be an Admin in your team’s workspace but a Viewer in a shared analytics workspace. The role in the JWT token reflects the user’s global role. Workspace-specific roles are checked separately when accessing workspace resources.

​
The first user

The first user created during setup automatically gets the Platform role — the highest privilege level. This user can then invite others and assign appropriate roles.