> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/workspace/manage-permissions.md).

# Manage roles and permissions

Configure Roles and Permissions in Siit: add admins, choose or create roles, restrict settings, archiving, request creation and AI agent log access, with HR and IT examples

### Overview

As your company grows, you’ll need to give access to more people — IT, HR, Finance, Ops, or team leads — while keeping sensitive information restricted to the right teams.

That’s where **Roles and Permissions** in Siit come in.\
They let you precisely control **who can access what**, ensuring each admin only sees and manages what’s relevant to them.

This article walks you through how to configure and manage roles based on common use cases — from adding a new admin to creating custom roles for specific needs.

#### Typical Use Cases

Here are some examples of how companies use Roles and Permissions in Siit to scale safely:

* **HR Teams** handle private employee requests (contracts, payroll, onboarding) without exposing sensitive data to IT or Ops.
* **IT Admins** manage devices, app access, and workflows, but cannot view HR threads or payroll data.
* **Finance Teams** access vendor invoices or expense approvals without seeing tickets from other departments.
* **Team Leads** can manage templates, workflows, or dashboards for their own inbox only — without touching global settings.

#### To add a new Admin:

1. Go to **Settings → Teammates**.
2. Click **New teammate** to open **Add a new admin**.
3. Search for the person by name or email.
4. If they're not in Siit yet, the search offers to invite that email as a new admin. You don't need to leave the modal or add them to your directory first.
5. Repeat for anyone else you want to add. You can add several people in one pass.
6. Choose a role for each person, then confirm. Invited admins receive an invite to log in.

#### Choosing the Right Role

Here’s a quick guide to help you decide which role fits your user best:

| Scope                                                                                  | Role              | Description                                                         |
| -------------------------------------------------------------------------------------- | ----------------- | ------------------------------------------------------------------- |
| You want someone to have full control of the workspace, including billing and security | **Owner**         | The highest-level role. Reserved for workspace and security owners. |
| You want full product control without billing rights                                   | **Super Admin**   | All features and data access, minus workspace deletion.             |
| You want HR teams to manage HR tickets and workflows privately                         | **HR Admin**      | Access limited to HR inboxes and private HR data.                   |
| You want IT teams to manage tools, connectors, and device requests                     | **IT Admin**      | Access to all IT-related features and integrations.                 |
| You want Finance teams to track and approve financial requests                         | **Finance Admin** | Limited to Finance inboxes and reporting.                           |
| You want Facilities or Ops teams to manage office-related requests                     | **Ops Admin**     | Access only to Workplace and Operations content.                    |
| You want a team lead to supervise a specific inbox or service                          | **Custom**        | You can fine-tune their visibility and permissions.                 |

#### Editing or Revoking Access

To modify or remove access:

1. Go to **Settings → Roles & Permissions**.
2. Select the user whose access you want to change.
3. Choose **Update Role** or **Remove Access**.
4. Changes apply instantly — ideal for handling departures or internal transfers.

#### Example Configurations

Here are some real-world examples of how roles can be configured:

### Example 1 — HR Admin

* Access: HR inboxes and services
* Permissions: View and edit private requests, manage workflows and templates
* Restrictions: No access to IT or Finance data

### Example 2 — IT Admin

* Access: All IT inboxes, integrations, workflows, and playbooks
* Permissions: Manage Okta, Jamf, and MDM connectors
* Restrictions: Cannot view HR private requests or payroll fields

#### Controlling who can archive or create requests

Two permissions let you decide which admins can archive requests and which can open new ones from the admin dashboard:

* **Ability to archive request**: admins without it no longer see the archive option in the request **…** menu, the keyboard shortcut, or bulk actions.
* **Ability to open request from Siit admin dashboard**: admins without it no longer see the **New request** button on the requests view.

To configure them per role:

1. Go to **Settings → Roles & Permissions**.
2. Select the role you want to edit.
3. In the role's permissions, turn **Ability to archive request** and **Ability to open request from Siit admin dashboard** on or off.
4. Click **Save**. Changes apply immediately.

**Example**

A service desk wants every request to come in through the Portal, Slack or Microsoft Teams, so incoming work always follows the same intake. It turns off **Ability to open request from Siit admin dashboard** for its agent role and keeps **Ability to archive request** for the leads who own inbox cleanup.

#### Configuring Settings access

Roles no longer grant a whole Settings category at once. Each role picks the individual elements it needs inside a category, for example Approval Policies on its own, without the rest of Workspace Settings coming along with it.

To configure this per role:

1. Go to **Settings → Roles & Permissions**.
2. Select the role you want to edit.
3. Under each Settings category, toggle the individual elements this role should reach.
4. Click **Save**. Changes apply immediately.

If a role has access to none of the elements in a category, that category no longer appears in its Settings menu at all.

**Note:** The `Settings` category itself stays available to the Owner role only. Every other category supports the per-element toggles above.

**Example**

An IT lead who shares Settings access with People Ops or Finance can hand over just Approval Policies, without opening the rest of the category next to it.

### Configuring AI Agent log access

By default, an admin's access to AI Agent conversation logs follows the same scope as their request access so someone limited to "My assignments and inboxes" sees only the agent logs tied to those requests, not the full log history.

To configure this per role:

1. Go to **Settings → Roles & Permissions**.
2. Select the role you want to edit.
3. Under each agent's section (for example **IT Agent** or **Triage Agen**t), find **Access to conversation logs**.
4. Choose the scope:
   * **All** -> see every log for this agent.
   * **My assignments and inboxes** -> see only logs tied to requests this role can already access.
   * **None** -> no access to this agent's logs.
5. If you want the role to also see AI conversations that never turned into a request, set **Include logs without request escalated** to **Yes**.
6. Click **Save**. Changes apply immediately.

<figure><img src="https://2274035325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlWFhpq2ia6gdHet0opKx%2Fuploads%2Fgit-blob-aa107ac6f8f1f78496216843537cddf10379e849%2FCleanShot-2026-07-23-at-10.08.11-2x.png?alt=media" alt=""><figcaption></figcaption></figure>

**Example**

An IT reviewer role with **My assignments and inboxes** access to requests will now see only the IT Agent logs behind those same requests — instead of every IT Agent conversation in the workspace.

**Frequently asked questions**

**Does this change existing roles?** No, roles keep their current setting until an admin changes it.

**Can I set a different scope for each agent?** Yes. Log access is configured per agent, per role, so IT Agent and Triage Agent (and any other agent) can have different scopes on the same role.

**What happens to conversations that never became a request?** They're excluded by default. Turn on **Include logs without request escalated** if you want scoped admins to see those too.

**I can't find the archive option on a request. Why?**\
Your role doesn't include **Ability to archive request**. Ask an admin who manages roles to turn it on for your role.

**The New request button has disappeared from my requests view. Why?**\
Your role doesn't include **Ability to open request from Siit admin dashboard**. Employees can still open requests from the Portal, Slack or Microsoft Teams.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.siit.io/guides/workspace/manage-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.