Roles and access

Open Admin → Roles & access. Editing roles requires Manage people (people:write). Each role row shows its key, how many people hold it, and its permissions.

Built-in roles

Role	Permissions
Learner	View assignments only — complete assigned work
Manager	View + manage assignments, view people, approve forms, review proofs, view reports
Admin	Everything except proof review — people, locations, settings, content, publishing, Forge, assignments, reports, form approval

Franchise-mode organizations also get Network Admin (full admin plus proof review, across the network) and Franchisee Admin (admin minus content editing, publishing, settings, and Forge). Built-in roles can be edited (Edit access) but the Learner, Admin, and Manager roles cannot be deleted.

The permission catalog

Permission	Label	What it unlocks
people:read	View people	See the member list; shows the Admin nav
people:write	Manage people	Invite, edit roles/status/location, manage roles
location:read	View locations	See locations
location:write	Manage locations	Add locations; shows the Admin nav
assign:read	View assignments	See and complete your own assigned work (every learner has this)
assign:create	Create assignments	Use Assign on Studio content
assign:manage	Manage assignments	See managed assignments and all readiness reports
content:read	View content	Read Studio content; export SCORM
content:write	Edit content	Create and edit courses, programs, documents, forms, proof gates; import SCORM
content:publish	Publish content	Publish any content type; list courses in the catalog
forge:run	Run Forge	Create and manage Forge ingest jobs
forge:publish	Publish Forge	Approve, reject, and publish Forge drafts
forms:approve	Approve forms	See and act on the form approval queue
proof:review	Review proofs	See and act on the proof review queue
reports:read	View reports	Document coverage, form CSV export, network rollup
settings:write	Org settings	Branding, organization mode, integrations; shows the Admin nav

The Admin nav item in the learner app appears for anyone holding people:read, people:write, settings:write, or location:write. Studio access requires at least one Studio-relevant permission — see Cannot open Studio.

Create a custom role

1. Under Create custom role, enter a Key — lowercase letters, numbers, and underscores, starting with a letter (for example shift_lead).
2. Enter a display Name (for example *Shift lead*).
3. Tick the permissions the role should grant.
4. Choose Create role.

The keys learner, tenant_admin, manager, network_admin, and franchisee_admin are reserved — you will see That role key is reserved if you try to reuse one. A custom role can only be deleted after it is removed from every member (Remove this role from all people first).