Permissions Reference

Permissions are stored as a bitmask on each role. The UI groups them into three sections when editing roles.

Team permissions

Permission	What it allows
Manage Team	Edit team name, avatar, visibility; manage roles (with rank rules)
Manage Members	Invite, revoke, kick members; change roles (with rank rules)
Manage Billing	View invoices, edit billing profile, open Stripe portal, change plan
Create Spaces	Create new top-level spaces
Manage Spaces	Edit/delete any space in the team; team-wide space admin

Space & page defaults

These apply team-wide as defaults for roles. Private spaces/pages still require explicit membership.

Permission	What it allows
Read Spaces	View spaces and their contents
Write Spaces	Create pages inside spaces
Manage Spaces	Space settings, members, delete space
Read Pages	View decision lists and decision detail
Write Pages	Create/edit decisions (subject to lifecycle freeze)
Delete Pages	Archive/delete pages and decisions
Post Comments	Add comments on decisions
Upload Files	Attach files to decisions/comments
Manage Comments	Moderate or delete others’ comments

Global authority

Permission	What it allows
Administrator (Owner flag)	Full bypass — equivalent to Owner role

Rank rules

When editing members or roles:

• You cannot modify users at or above your rank (except Owner).
• You cannot assign a role above your own rank.
• You cannot grant permission bits you do not hold (except Owner).

Private spaces & pages

If a space or page is Private, the user must appear in that space’s or page’s member list even if their team role would otherwise allow access. Owner always bypasses this.

API vs UI

The app exposes effective permissions as myPermissions on team/space/decision payloads. The UI hides buttons (Create Space, Decision, Settings, Export, etc.) when the relevant bit is absent.