The permission audit is an Excel workbook that lists every user, every role, the role memberships and the permissions behind them. Download it when you review who can do what across the whole company, or when you need one complete list of access.
Your browser saves the workbook as audit_export_ plus the download date, for example audit_export_2026-10-15.. The icon shows a spinner while the workbook is prepared.
You need the Permission Audit Downloader permission. For what each permission allows, see Permission reference.
Every download covers the whole company: all roles and all users, active and inactive. There is no filter for one role or one user.
The workbook holds seven sheets:
| Sheet | What it holds |
|---|---|
| Summary | How and when the workbook was generated, the counts, a guide to the other sheets and the legend. |
| Users | Every user, their role assignments, how many granular permissions apply to them, and whether the permissions come from roles or a direct override. |
| Roles | Every role, how many users hold it and how many permissions it holds on each tier, with a total row. |
| Role Membership | One row for each user and role pair. |
| Role Permissions | One row for each permission saved on a role, with the tier it is saved on. |
| User Effective Permissions | One row for each permission that applies to a user, with its source and, for inherited grants, the role it comes from. |
| Permission Catalog | Every permission the platform defines, listed by module, subject and action. |
The Summary sheet starts with how the workbook was generated:
| Row | What it shows |
|---|---|
| Generated At | The date and time the workbook was created. |
| Generated By | The name and email of the person who downloaded it. |
| Scope Filter | That the export covers every role; it is not narrowed. |
| Schema Version | The version of the workbook layout. It reads 1.. |
Below that, the sheet lists counts:
| Count | What it counts |
|---|---|
| Total Users | The users in the workbook. |
| Active Users | Users whose account is active. |
| Inactive Users | Users whose account is deactivated. |
| Users w/ Direct Permission Override | Users whose permissions are set on the account instead of inherited from roles. |
| Total Roles | All roles, active or not. |
| Active Roles | Roles that currently grant access. |
| Total Granular Permissions in Catalog | The granular permissions the platform defines. |
| Total Role-Permission Assignments | The permission entries saved on all roles, counting presets, standard permissions and granular permissions separately. |
The sheet closes with a guide to the other sheets and the legend.
Two labels tell you where a permission comes from:
In the Users sheet, the Inheritance Mode column labels each user Inherited or Direct (Override). In the User Effective Permissions sheet, the Source column labels each row Inherited or Direct; an inherited row also names its role in the Via Role column, while a direct row leaves Via Role empty.
For how role permissions and direct permissions combine for a user, see How access works.
Yes. The Users sheet marks each account as active or not, and the Summary counts Active Users and Inactive Users separately.
No. Every download covers all roles and all users, active and inactive. The Scope Filter row on the Summary sheet shows the export is not narrowed.
The platform's built-in system account is the only account left out; it never appears in the workbook or in the Users list. All other accounts are included, including deactivated ones.
It counts the users whose permissions are set on their account instead of inherited from roles: the users marked Direct (Override) in the Users sheet.
No. The Audit download on Users and the one on Roles and permissions produce the same workbook, covering both.
No. A failed download saves no file, not even a partial one. A message shows the reason, or reads "An unknown error occurred" when there is none. Try again; if it keeps failing, ask an administrator to check that your role still includes Permission Audit Downloader.
No. It covers users, roles, membership and permissions. To check table access, open the role and manage its tables, as described in Roles and permissions.
No. The download is a read-only export. It does not change users, roles or permissions.