# User Management & Permissions

# User Management & Permissions

## Roles

Codecks differentiates between **org-wide roles** and **project-specific** roles.

Here's a high-level overview of org-wide roles:

- #### `Owner`

  Assigned to the creator of an organization. There may only be one owner.

- #### `Admin`

  Have access to all projects and can manage billing and integrations.

- #### `Staff`

  May access assigned projects only. Can be assigned the project-specific `Producer` role and [add-on roles](#add-on-roles).

- #### `Observer`
  May access assigned projects only. They can't change any data but may add comments to cards.

Users with the `Staff` role may be given the project-specific `Producer` role. A producer can manage Decks, Runs and Milestones for the project. The producer role is available to organizations with the [Pro plan](https://manual.codecks.io/plans/).

## Project Visibility

`Admins` and `Owners` have access to all projects. Projects have a visibility setting which determines if all `Staff` members can access a project or whether they need to be explicitely added. `Observers` always have to be explicitely added, no matter the project visibility setting.

`Limited` Project Visibilty is available in the [Pro plan](https://manual.codecks.io/plans/).

![Project creation with project visibility option](https://manual.codecks.io/_astro/project-visibility.B-m_SjUN_nWMm9.webp)

## Add-on Roles

`Admins` and `Owners` can give `Staff` members extra permissions on top of their role. Open the project access overlay for a user in **User Management** and switch on:

- **Set up integrations** — lets the user add, change and remove the organization's integrations.
- **Create and update Journey templates** — lets the user maintain the organization's Journey templates.

`Admins` and `Owners` have both permissions already.

> It often makes sense to create multiple Codecks projects for a single game. This allows you to share different parts of the game project management with different collaborators. See this [blog post](https://www.codecks.io/blog/2021/game-production-case-study-maschinen-mensch/) for an example of how to use to a private CEO project.

## Permissions

### `Limited` vs `Full` Staff Permissions

`Admins` and `Owners` can set Staff Permissions with the **User Management** screen. `Full` Staff Permissions allows all Staff members to

- Create and manage Decks
- Create and manage project-specific Runs and Milestones
- Manage global Runs and Milestones
- Manage Journeys
- Manage Project Tags

in the projects they have access to.

### Permission Matrix

The list below shows the minimum role that has permission to perform or access the corresponding actions.

Here's the full hierarchy to know what a minum role implies:
`Owner > Admin > Producer > Staff > Observer`

This means that if a `Producer` is allowed to perform a certain action, then the `Owner` and `Admins` are also allowed to do it.

Entries marked with `Staff*` imply that `Staff Permissions` are set to `Full`. Otherwise these actions are only available to `Producers`.

#### Organization-based Permissions

| Action                                     | Minimum Role |
| ------------------------------------------ | ------------ |
| Can view user overview                     | `Observer`   |
| Can manage integrations 1                  | `Admin`      |
| Can manage billing                         | `Admin`      |
| Can invite users                           | `Admin`      |
| Can assign org-wide roles (except `Owner`) | `Admin`      |
| Can manage organization settings           | `Admin`      |
| Can delete attachment files                | `Admin`      |
| Can disable organization                   | `Owner`      |
| Can assign different Owner                 | `Owner`      |

1 `Staff` members with the **Set up integrations** [add-on role](#add-on-roles) can manage
integrations as well. They see all integrations, but project or deck names they don't have access to
won't be shown, and they may only pick target decks from projects they are producer of.

#### Project-based Permissions

| Action                                                     | Minimum Role          |
| ---------------------------------------------------------- | --------------------- |
| Can modify and archive project                             | `Producer`            |
| Can manage user project access for `Staff` and `Observers` | `Producer`            |
| Can assign project-specific user role                      | `Producer`            |
| Can make project public                                    | `Producer`            |
| Can create and manage project tags                         | `Producer` / `Staff*` |
| Can create project                                         | `Admin`               |
| Can delete project                                         | `Admin`               |
| Can change default access for `Staff` and `Observers`      | `Admin`               |

#### Run-based Permissions

| Action                                      | Minimum Role          |
| ------------------------------------------- | --------------------- |
| Can assign cards to Runs                    | `Staff`               |
| Can create and manage project-specific Runs | `Producer` / `Staff*` |
| Can manage global Runs                      | `Producer` / `Staff*` |
| Can create global Runs                      | `Admin`               |

#### Milestone-based Permissions

| Action                                            | Minimum Role          |
| ------------------------------------------------- | --------------------- |
| Can pin milestone                                 | `Staff`               |
| Can assign cards to milestones                    | `Staff`               |
| Can create and manage project-specific milestones | `Producer` / `Staff*` |
| Can manage global milestones                      | `Producer` / `Staff*` |
| Can create global milestones                      | `Admin`               |

#### Deck-based Permissions

| Action                                    | Minimum Role          |
| ----------------------------------------- | --------------------- |
| Can assign cards to decks                 | `Staff`               |
| Can create and manage decks               | `Producer` / `Staff*` |
| Can create and manage journeys            | `Producer` / `Staff*` |
| Can set preferred card sort order in deck | `Producer`            |
| Can modify public deck's deck order       | `Producer`            |

#### Card-based Permissions

| Action                       | Minimum Role |
| ---------------------------- | ------------ |
| Can bookmark card            | `Observer`   |
| Can create & modify card     | `Staff`      |
| Can create card preset       | `Staff`      |
| Can delete own card preset 2 | `Producer`   |
| Can delete any card preset   | `Admin`      |

2 Card presets are deleted in the **Card Presets** tab of the organization settings, which
`Staff` members can only open if they are producer of at least one project or have the **Set up
integrations** add-on role.

## Invite Users

If you open the Mission Control via the Joystick icon at the top left, you'll find the `User Management` section. This contains an overview of the current users as well as two options for inviting new members to your organization if you are an admin or owner.

### Invite via E-Mail

This option allows to invite users on a one-by-one basis by entering their email. This will sent a message to the entered email containing a link that allows to join your invitations. This option allows to define the user's role as well as which project access this user should get.

### Invite via Link

If you want to invite multiple team members in one go, you can generate an invite link. This will allow anyone who has access to it to join your organization. The person creating the link will receive a confirmation email for each person joining. The invited people will join as staff members with the default project accessiblity rights.
You can disable this link anytime by pressing the "Disable Link" button.