Etienne
0edd8d400c
Fix sentry issues https://twenty-v7.sentry.io/issues/7203797925/?environment=prod&project=4507072499810304&query=is%3Aunresolved%20assigned%3Ame&referrer=issue-stream An orphaned sub is a not "canceled" stripe sub with no matching workspace - Clean all orphaned sub (script not included in this PR) - Ensure to soft delete > cancel stripe sub > check for not active sub > hard delete in every workspace deletion flow Bonus : - Remove dead code - Update doc on RLS (to improve AI chat knowledge)
122 lines
4.4 KiB
Plaintext
122 lines
4.4 KiB
Plaintext
---
|
|
title: Permissions FAQ
|
|
description: Frequently asked questions about roles and permissions.
|
|
---
|
|
|
|
## Roles
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="What roles come with Twenty by default?">
|
|
Twenty comes with an **Admin** and **Member** roles by default. You can create additional custom roles based on your team's needs (e.g., Sales Rep, Manager, Read-Only User).
|
|
</Accordion>
|
|
|
|
<Accordion title="Can I delete the Admin role?">
|
|
No, the Admin role cannot be deleted. There must always be at least one member assigned to the Admin role.
|
|
</Accordion>
|
|
|
|
<Accordion title="What happens when I delete a role?">
|
|
Any workspace member assigned to that role will be automatically reassigned to the default role.
|
|
</Accordion>
|
|
|
|
<Accordion title="How do I set a default role for new members?">
|
|
Go to **Settings → Members → Roles**, find the **Default Role** option, and select which role new members should automatically receive when they join.
|
|
</Accordion>
|
|
|
|
<Accordion title="Can I assign multiple roles to one user?">
|
|
No, each user can only have one role at a time. Create a custom role if you need a combination of permissions.
|
|
</Accordion>
|
|
</AccordionGroup>
|
|
|
|
## Permissions
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="What's the difference between object and field permissions?">
|
|
- **Object permissions**: Control access to entire records (e.g., can see/edit/delete People records)
|
|
- **Field permissions**: Control access to specific fields within an object (e.g., can see but not edit the Salary field)
|
|
|
|
Field permissions allow more granular control over sensitive data.
|
|
</Accordion>
|
|
|
|
<Accordion title="How do permission overrides work?">
|
|
Permissions cascade from global to specific:
|
|
1. **All Objects** sets the baseline for all objects
|
|
2. **Object-Level Permissions** can override the global setting for specific objects
|
|
3. **Field-Level Permissions** can override the object setting for specific fields
|
|
|
|
More specific settings always take precedence.
|
|
</Accordion>
|
|
|
|
<Accordion title="What do the different permission levels mean?">
|
|
For objects:
|
|
- **See Records**: View records in lists and detail pages
|
|
- **Edit Records**: Modify existing records
|
|
- **Delete Records**: Soft-delete records (can be restored)
|
|
- **Destroy Records**: Permanently delete records
|
|
|
|
For fields:
|
|
- **See Field**: View the field value
|
|
- **Edit Field**: Modify the field value
|
|
- **No Access**: Field is completely hidden
|
|
</Accordion>
|
|
|
|
<Accordion title="Can I restrict access to specific records (row-level permissions)?">
|
|
Row-level permissions are available on the **Organization** plan. This allows you to restrict access to specific records based on criteria (e.g., only see your own opportunities).
|
|
</Accordion>
|
|
|
|
<Accordion title="How do I make a field read-only for certain users?">
|
|
1. Go to **Settings → Members → Roles**
|
|
2. Select the role
|
|
3. Navigate to the object containing the field
|
|
4. Set the field permission to **See Field** (without Edit Field)
|
|
</Accordion>
|
|
</AccordionGroup>
|
|
|
|
## Settings & Actions
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="What settings permissions are available?">
|
|
You can control access to:
|
|
- API key generation
|
|
- Workspace preferences
|
|
- Role assignment
|
|
- Data model configuration
|
|
- Security settings
|
|
- Workflow management
|
|
|
|
Use **Settings All Access** to grant full access, or enable specific permissions.
|
|
</Accordion>
|
|
|
|
<Accordion title="What action permissions are available?">
|
|
You can control:
|
|
- **Send Email**: Ability to send emails from Twenty
|
|
- **Import CSV**: Ability to import data via CSV
|
|
- **Export CSV**: Ability to export data to CSV
|
|
|
|
Use **Application All Access** to grant all actions, or enable specific ones.
|
|
</Accordion>
|
|
</AccordionGroup>
|
|
|
|
## SSO
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Is SSO available on all plans?">
|
|
No, SSO is a Premium feature available on the **Organization** plan only.
|
|
</Accordion>
|
|
|
|
<Accordion title="Which identity providers are supported?">
|
|
Twenty supports:
|
|
- **SAML 2.0** (works with most enterprise identity providers)
|
|
- **Google Workspace**
|
|
- **Microsoft Entra ID** (formerly Azure AD)
|
|
</Accordion>
|
|
|
|
<Accordion title="What is Just-in-Time (JIT) provisioning?">
|
|
With JIT provisioning, user accounts are automatically created in Twenty when someone logs in via SSO for the first time. They're assigned the default role automatically.
|
|
</Accordion>
|
|
|
|
<Accordion title="Can I require SSO for all users?">
|
|
Yes, once SSO is configured, you can disable password login for SSO users to enforce authentication through your identity provider.
|
|
</Accordion>
|
|
</AccordionGroup>
|
|
|