Roles and permissions

DataMind Platform keeps a single role catalogue. A role is a named set of permissions. The catalogue is global, not per company: what a member can do comes from the roles they hold in their company.

A company reader needs Assign User Roles or Invite Users to read the catalogue. Creating and changing roles is a DataMind staff action; see Staff accounts for DataMind's own accounts.

Built-in bundles

Five bundles come with the platform. They are read-only: DataMind manages their permissions and updates them with the platform. For anything they do not cover, create a custom role.

Bundle	What it is for
Integrator	DataMind sales/onboarding staff: creates client companies, invites their users and manages their tier menus.
Administrator	Full access to every platform capability.
Billing Manager	Manages invoices and subscription plans.
Developer	Manages API keys and views the billing plan.
Viewer	Read-only access across the platform.

A custom role is never replaced by a built-in bundle, even if their names collide.

The permission catalogue

A role holds a set of permissions from this catalogue:

Permission	What it allows
View Company	See the company's details.
Create Company	Create a company. DataMind staff roles only.
Update Company	Change the company's details.
View API Keys	See the company's API keys.
Create API Key	Create the company's API key.
Rotate API Key	Replace the key's secret.
Revoke API Key	Disable the key permanently.
View Users	See the company's members.
Update User	Change a member's name and active status, and unlock a locked member.
Assign User Roles	Change which roles a member holds.
Invite Users	Invite members and manage invitations.
View Invoices	See the company's invoices.
Refund Invoice	Refund a paid invoice. DataMind staff roles only.
View Plan	See the plan, its allowances and the enforced spend cap.
Change Plan	Change the plan and the company's spend cap.
Assign Company Tiers	Set which plans a company can choose from. DataMind staff roles only.
View Usage	See the usage dashboards and the request log.

Create Company, Refund Invoice and Assign Company Tiers are staff-level permissions: only a role created as a DataMind staff role can hold them, and saving one of them on any other role is refused. Deactivating a company is not part of the catalogue: no role grants it.

Create a custom role

Its name can be up to 100 characters and must be unique. A name already in use is refused with Role "<name>" already exists, on create and on rename.
It starts active, so it can be used as soon as it is created.
A role can be marked as a DataMind staff role. The mark is set at creation, cannot be changed later, and decides whether the role may hold staff-level permissions.

Change a role

Rename a role, update its description, or replace the permissions it holds. Renaming follows the same uniqueness rule as creation.

Important

A saved permission set replaces the role's whole set. Include every permission the role should keep; anything left out is removed.

Deactivate a role

There is no delete. Deactivation is the delete: the role stops granting its permissions at once, and its members keep the role but get nothing from it. Activate the role again to restore it. Deactivated roles stay in the staff view and disappear for companies.

What companies see

Company readers see only the active roles that are not staff bundles. Staff bundles and deactivated roles are not offered to them, and a request for one answers Role not found. Members and their roles are managed in Users and invitations.

Roles in the support view

The support view narrows a staff session to one role's permissions; it never adds rights. Only active roles that are not staff bundles can be chosen. If the chosen role stops being available, the session grants nothing.

Questions, answered

Which roles are built in?

Five. Integrator is the staff bundle; the others are Administrator, Billing Manager, Developer and Viewer. See the table above for what each one is for.

Is a role tied to one company?

No. The catalogue is global and shared by every company. What a person gets comes from the roles they hold in a specific company.

Can I edit a built-in role?

No. The built-in bundles are read-only and managed by DataMind; changes to them are refused. Create a custom role for anything they do not cover.

Will a built-in bundle ever overwrite my custom role?

No. A custom role is never replaced by a built-in bundle, even if their names match.

Why was a duplicate role name refused?

Role names are unique across the catalogue. A create or a rename to a name already in use is refused with Role "<name>" already exists; choose a different name.

When I save a role's permissions, do they replace the old ones?

Yes. A save replaces the role's whole set: include every permission the role should keep, and anything left out is removed.

How do I delete a role?

There is no delete. Deactivate it instead: the role stops granting its permissions at once, and its members keep the role but get nothing from it. Activate it again to restore it.

Why can't I add Create Company to a company role?

Create Company, Refund Invoice and Assign Company Tiers are staff-level permissions. Only a role created as a DataMind staff role can hold them; saving one of them on any other role is refused.

Why does a company see fewer roles than DataMind staff?

Company readers see only the active roles that are not staff bundles. Staff bundles and deactivated roles are not visible to them, and a request for one answers Role not found.

Does the support view add any access?

No. The support view only narrows a session to the chosen role's permissions. Only active roles that are not staff bundles can be chosen, and a role that is no longer available grants nothing.

How quickly does a role change take effect?

A member gets the new permissions at their next sign-in. A support-view session picks up a role edit within a minute.