Roles and permissions for a small team workspace

Roles and permissions decide two separate things in a team workspace: what a person can do, and what a person can open. Small teams often skip both until something goes wrong, such as an intern who can delete the client folder, or a contractor who still sees last year's salary sheet. This guide shows a simple way to set them up, the mistakes to avoid, and a review routine that takes an hour twice a year. The ideas apply to any tool. Where we show a product, it is nerix.

Two questions, not one

Most confusion comes from mixing them up.

What can this person do? Invite people, change billing, create folders, delete files, export data. This is a role.

What can this person open? The payroll folder, the board minutes, one client's documents. This is access.

A good setup answers both separately. Roles are few and apply to everyone with that job. Access is set on the folders and documents that need protecting, and everything else stays open to the workspace.

Start from the principle of least privilege

Give people the access their work needs, and no more. It sounds strict, but in a small team it mostly means one decision made once: who is an admin. Many teams make everyone an admin because it is easier, then discover that anyone can delete or export everything.

A workable starting point:

Add custom roles only when a real job needs them, such as a billing manager who handles invoices but not hiring, or a support agent who answers customers but sees no finances.

Set access on the few things that need it

Resist locking everything. A workspace where every folder is private becomes a place where people cannot find the thing they need and ask an admin each time. Keep the default open, and lock a short list:

• payroll and pay reviews;
• HR files, warnings and contracts (see how to write an employee warning letter for what such files contain);
• board or partner papers;
• client files covered by confidentiality;
• security notes and passwords documentation.

Use three levels. Can view lets a person open and read. Can edit lets them change and upload. Can manage lets them also decide who else can open it. Give manage to as few people as possible.

What good tools get right

Whatever product you use, check these points, because they separate real access control from a label.

1. Limits follow into search. If someone cannot open a folder, they should not see its name in search results either.
2. Limits follow into AI answers. An assistant that answers from your documents must answer only from what the asking person can open. Otherwise a chat window becomes a way around the permissions.
3. Limits go down the tree. What is inside a limited folder is limited too, and can be narrowed but never widened.
4. Exports respect access. An export should leave out what the exporting person cannot open.
5. Nobody can grant more than they hold. A role builder that lets an admin create a role stronger than their own is a hole.
6. There is a way to see. You should be able to check what a person sees, and who can open a given folder and why.

How nerix handles it

Roles and access in nerix follows those points. Every workspace has Owner, Admin, Member, Viewer and Guest, and you can make your own role from blank, from a built-in role or from a ready-made one such as Billing manager, Library manager, Team lead, Support agent or Auditor. Nobody can build a role that can do more than they can, and a role that someone holds cannot be deleted until they have another. Preview as this role shows the app as that role would see it, read only, and you can compare two roles side by side.

On any folder or document you choose Everyone in the workspace, which is the usual, or Only these people, teams and roles, with the three levels above. A person who cannot open a folder does not see its name or contents in the library, search, the assistant's answers and sources, widgets, exports or share links. nerix answers only from what the person asking can open, and an automation reads only what its maker can open. An Access page shows the library as a tree with every limit, lets you pick a person to see what they see, or pick a folder to see everyone who can open it and why.

Two honest limits. An admin's reach is limited like anyone's: only the owner can open a limited folder as owner, with a written reason, for eight hours, recorded and with the folder's managers told. And a role made earlier does not receive a permission added later until someone adds it, which is safe but means a review after updates. Details on security and how the library is organised are on their own pages.

A review routine for twice a year

Put this in the calendar. It takes about an hour for a team of twenty.

1. List admins and owners. Is each still needed? Two owners is enough for most teams, so one person on leave never blocks you.
2. List people outside the company. Guests, contractors and former staff. Remove any whose work has ended.
3. Open the access view of each locked folder. Is the list of people still right?
4. Check leavers. Everyone who left in the period should be gone. Do this on the last day, not at the review.
5. Look for workarounds. Shared logins, files copied into open folders, screenshots in chat. They show where the rules hurt.
6. Write down what you changed. One paragraph in the same place each time.

Common mistakes

Everyone is an admin. It feels friendly and removes the point of roles.

Permissions per person. Setting rights one person at a time fails the day someone changes job. Use roles and teams.

One shared account. You lose the record of who did what, and you cannot remove one person.

Forgetting leavers. Remove access on the last working day.

Locking too much. If people cannot do their jobs they will copy files into places you do not control.

The short version

Separate what people can do (roles) from what they can open (access). Keep few roles, make members the default, lock a short list of sensitive folders and check that search, assistants and exports follow the same limits. Review twice a year and on every departure.