Understanding Roles and Permissions

Updated April 20, 2023 13:22

Every user added to your workspace will be assigned a role. This role designates what permissions they have to be able to view, edit, create and delete elements within the workspace. It also allows or denies access to certain features, management of users, and system settings.

By default, when a new user is created, they are assigned the 'User' role. In basic terms, this allows them to see all open projects and change the status of all tasks. It does not allow for any editing of System Settings. You can change the Default role under System settings > Security > Settings.

It is unlikely that this 'User' role will work for all users, so in this article, you will learn about the other roles available and how to assign them to your users.

Default Roles

The five roles available out of the box are:

(Open the thumbnail to see the full permission list)

Restricted user This user can only see the projects they are assigned to and only change the status of assigned tasks. Suggested for restricted external vendors or creative/team users.
User This user can see all open projects and change the status of all tasks. Suggested for lead creatives and project coordinators.
Project Manager This user can create, edit and remove projects and project-related objects (except users). Suggested for producers or project managers who need more control of project elements.
Administrator This user can change everything in ftrack, add and remove users, and see all data in the system. Suggested for the person who manages the ftrack workspace. As mentioned in our Launching your Studio Workspace article, this role is for the System Administrator - the person with the most control over how your workspace and project workflows function. As a best practice, the Admin role should be considered carefully and only designated to one or a few people at most, depending on your company size and locations.
API This user role can only be used to generate global API keys.

Please note: If you have a creative supervisor, they could function within either the User or Project Manager roles, depending on their project responsibilities. It is possible that you may need to create a new role with unique permissions for this position.

If you need more refinement, you can refer to the section "Create a New Role" in the Managing User Roles and Permissions article.

Assign a Role to a User

After creating your users, you need to go into each account and update their roles if you want them to be something other than 'User' as defined above.

Quickstart Guide

	Go to System settings > Resources > Users and Groups to find your Users page.
	Hover over a user whose role you want to change and click the Person/Roles icon to the left of their profile picture. This opens the Role Manager for that user.
	Hover over the existing role on the left of the dialog and click the Trash icon to remove it.
	At the top left, there is the Roles dropdown menu. Click the 'Select...' empty field to open the menu and select the new role.
	Click ADD to the right to add that role for your user.
	Click Save Changes to complete the update.
	Repeat until your user roles are defined as needed.

Tip: The default roles should cover most project needs, but if you would like to explore customizing them further, please view the article below, where we go into more detail on managing roles and creating new roles.

Managing User Roles and Permissions

User Permissions to all Open Projects and Private Projects.

Once you create a project (our next section of the Getting Started series!), you have a few options available to you for project access.

Open project access gives the user automatic access to any project that is not listed as private.
- This is ON automatically in the default 'User' role when a new user is created.
Private project access is by "add" invite only from either the user role or project Team page to any project listed as private.
Closed project access means you have to permit the user access to each individual project, whether the project is private or not.

Manage Role Dialog

You can find all user project access options in the Manage role dialog:

Open - To allow access to all open projects, switch the All Open Projects toggle to 'ON'. This does not include access to Private projects.
Private - To allow access to private projects, select the project from the Projects dropdown on the right and click ADD. The project must be listed as private to appear here.
Closed - For closed project access, switch the All Open Projects toggle to 'OFF'. With this off, you must add the user to every project or add the project to their permission role.

Don't forget to Save Changes!

Tip: A user can have more than one role. This is useful when you want users to have different access permissions for different projects.

Add more than one role to the user in the Role dialog.
Select the first added role (in the left panel).
Specify project access for that role (in the right panel)
Repeat for each role.
Save your changes once all roles are adjusted.

Example:

On Project 1, an artist may be a lead and have the 'User' role so they can approve tasks.

On Project 2, they are an artist and have the 'Restricted User' role where they can only edit what is assigned to them.

Team Page

Another way to add private project access is from the project's Team page.

Click on the Projects dropdown in the main navigation bar and select your project.
Click on the Team page in the project menu.
Ensure that the project has Private access on.
Click the Add user access button to add a user to that project which opens a dialog.

Select the User on the left and the Role you would like them to have for that project on the right. Click ADD, then Save.

For closed project access, the invite process will be the same, but the Private Access toggle will be OFF.

Tip: If you would like to learn more about project privacy, you can visit the article below.

Private Projects