Server-Enforced Permissions & Roles: Access control that can’t be bypassed from the browser
Organization roles, custom roles and per-space, category or room overrides. The server checks them every time, so nothing is just hidden in the interface.
Two axes, not one
Platform roles are for us, running the service. They are entirely separate from your organization’s own roles: Owner, Admin, Manager, Member and Guest. You can add custom roles, then per-space, per-category and per-room overrides on top.
- A denied permission is refused by the server, not just hidden in the UI
- Overrides inherit room ← category ← space, and a deny always wins
- The Owner always keeps every permission, so an organization can never lock itself out
Changes take effect immediately
When a role loses access to a room, the room disappears from the sidebar. The server refuses the request even if the browser tab hasn’t caught up yet. Access is never enforced by the frontend alone.
What does the server check?
It checks every permission and every plan limit. The interface shows what you can do, but it doesn’t decide it. Each organization’s data is also isolated, so a session in one organization can’t reach another’s.
Are permission changes recorded?
Yes, on Business, Enterprise and Education. Role changes and permission overrides land in the audit log automatically, with nothing to turn on.
Keep reading
Bring the whole conversation together.
Set up a workspace in a couple of minutes. Free for up to 5 members, no credit card required.
