Create custom roles and grant direct permissions

By the end, your organization has a role tailored to your operation — and you give a person a permission on a single object or take it away.

Steps#

Read the comparison matrix#

The Roles tab shows a comparison matrix: the roles as columns and the permission areas (column Permission area) as rows. Each cell says all, gives a fraction (“4 of 9 permissions”), or shows a dash. The column header shows the number of permissions and the phrase used by 3 people. A role you are not allowed to assign shows Not grantable there, along with the reason: “contains 2 permissions you do not hold” or “only an owner can assign this role.”

In the Starter package, the tab shows Read-only.: “Managing roles starts with Pro.”

Create a custom role#

1. Click Create role. The dialog New role (“Create a custom role; assign permissions afterwards in the editor.”) asks for Name and Description.
2. Open the new role from its column header. The editor has two sections: Details for name and description, and Permissions for the permission set: “Expand a resource group and select the permissions.”
3. Select the permissions. The picker shows the permission catalog of your organization with a plain-language description for each permission. What you do not hold yourself stays visible but is disabled: “You can only grant permissions you hold yourself.”
4. Click Save. Role saved appears.

For the most common case, one click is enough: Below the matrix is the Template “Content reader” — Member plus read access to media, scenes, playlists and schedules. The template disappears as soon as the role exists.

Delete a role#

To delete a custom role, use the menu in the column header or Delete role in the editor. Confirm the Delete role? prompt with Delete permanently. This works only as long as nobody holds the role anymore. If someone still holds it, the entry is disabled: “Still held by 3 people — assign a different role first.” If the role is set as the default role of a company sign-in, the note asks you to set a different one there first. Built-in roles have no menu. They are read-only.

If someone saved the role at the same time, the portal asks The role changed in the meantime and lets you choose between Keep draft and Load the other version. Nothing is silently overwritten.

Grant or revoke a direct permission#

Open the person’s entry and go to the section Direct permissions (grants): “Fine-grained permissions on individual resources; deny always wins.”

1. Choose the kind: Allow or Deny.
2. Choose the resource type (Scene, Playlist, Schedule, Display, or Media item) and the object within it. With Enter an ID, you enter it directly (such as scn_…). With Pick from list, you search for it.
3. Under Pick a permission …, choose the relevant permission and click Create grant.

To remove an existing direct permission, click Revoke. A Deny always wins: no role and no second allow can override it.

Check the result#

• The new role appears as its own column in the matrix, with its permission count and, at first, no one holding it.
• After you create a direct permission, Grant created appears, and after you remove one, Grant revoked.
• Both appear in the Change log with your name.

If something goes wrong#

Related#

• Who can do what in the portal?
• Permissions by role and by area
• Manage members: change role, block, remove