Wevion RBAC is two-tier: Organization roles (owner/admin/member) and Team roles (manager/mediabuyer/finance/viewer). What each can do, when to pick which.

Roles and permissions in 5 minutes

Wevion RBAC is two-tier. Your Organization role (owner, admin, member) sets your standing in the Org. Your Team role (manager, mediabuyer, finance, viewer) sets what you can do on the Workspaces your Team is linked to — you inherit that Team role on every linked Workspace. Backend permissions are enforced through explicit role groups and route guards, so don't assume pure inheritance from a single ladder. Authoritative source: docs/architecture/RBAC-HIERARCHY.md.

Who is this for

Admins picking roles when inviting teammates, and anyone trying to understand what they can or cannot do.

The two tiers at a glance

Organization roles — your role in the Org (billing, seats, membership):

Team roles — your role inside a Team (a group of people), inherited on the Workspaces that Team is linked to:

Your effective access on a Workspace is the highest Team role among your Teams linked to that Workspace (Org owner/admin override this with admin-level access everywhere). super_admin is not a role you assign — it's an internal platform-staff bypass, so it doesn't appear in these tables.

Detailed permission matrix

The table below is a practical guide, not an exhaustive spec. Under the hood, access is enforced by role groups rather than a strict cell-by-cell mapping, so a few edge actions may behave slightly differently — if a specific permission is business-critical for you, confirm it in the app for your role.

The admin/owner column is Org owner/admin (admin-level everywhere); the other columns are Team roles.

Org owner/admin can do everything across every Workspace in the Organization.

How to pick a role

• Default for a new teammate: put them in a Team whose role is mediabuyer if they actively run ads, viewer if they just need visibility.
• Promoting someone: change their Team role one tier at a time as trust grows. There's no "approver" workflow inside Wevion — once an admin changes a role, it applies immediately.
• Access to multiple Workspaces: link the Team to several Workspaces, or place the person in multiple Teams. Their effective role on each Workspace is the highest Team role that reaches it. Common agency pattern: a senior is in a manager Team for production Workspaces and a viewer Team for client-self-serve Workspaces.
• Finance: read-only on performance, with no edit power. Invoices and billing stay with the Organization owner.

Changing a role

A person's Team role (what they can do on the Workspaces the Team reaches) and their Organization role (owner/admin/member) are set separately. To change a Team role, open Settings → RBAC → Teams (/settings/rbac/teams), open the Team, and pick the new role next to the person in its Members tab; a Role updated confirmation appears.

Audit log

Every role change, invite, and member removal is recorded in Settings → Team → Audit Log (/settings/team/audit-log). Available to admins and owners. Retention duration depends on your plan — see /settings/team/billing for the current value.

A note on super_admin

super_admin is not a role you assign to teammates. It's an internal platform-staff global bypass used by Wevion operations, not something an Organization owner grants. Inside your Organization, the highest customer-facing role is owner.

Common questions

• Can the same user reach two Workspaces but pay for only one seat? Yes. Seats are per-user, not per-membership.
• Can I make a custom role? Not yet. You're limited to the built-in Organization roles (owner/admin/member) and Team roles (manager/mediabuyer/finance/viewer). Custom RBAC is on the roadmap.
• Does finance see ad performance? Yes, read-only. They cannot edit campaigns, and billing (invoices, plan, payment methods) stays with the Organization owner.
• Can a viewer use Wavo? Yes, but Wavo cannot perform actions for viewers (it can only suggest). Action permissions follow your role.

FAQ

How many roles does Wevion have?

Wevion uses a two-tier model. Organization roles — owner, admin, member — set your standing in the Org. Team roles — manager, mediabuyer, finance, viewer — set what you can do on the Workspaces your Team is linked to. super_admin is an internal platform-staff bypass, not an assignable role. Backend permissions are enforced through explicit role groups and route guards — check the permission matrix, or docs/architecture/RBAC-HIERARCHY.md, for exactly what each role can do.

How is my role on a Workspace decided?

Access to a Workspace comes through a Team: you join a Team, the Team is linked to Workspaces, and you inherit that Team's role on those Workspaces. Your effective role on a Workspace is the highest Team role among your Teams that reach it. Org owner/admin are the exception — they have admin-level access across every Workspace without a Team. There is no "add a member directly to a Workspace".

Who can view billing and change the subscription plan in Wevion?

The Organization owner manages billing: the billing page, with invoices, plan changes, and payment methods, is reserved to the owner. Billing is organization-level — there is one subscription per organization (subscription.organization_id), not one per workspace. The finance Team role doesn't see billing in the app.

How do I change someone's role in Wevion?

A Team role (what they can do on linked Workspaces) is changed from the Team's Members tab under Settings → RBAC → Teams (/settings/rbac/teams): pick the new role next to the person and a Role updated confirmation appears. The Organization role (owner/admin/member) is a separate setting.

Is super_admin a role I can assign?

No. super_admin is an internal Wevion platform-staff global bypass, not a role an Organization can grant. Inside your Organization the highest role is owner, set automatically on the user who creates the Organization (the first signup).

Related articles

• Workspace, Team, Account — what's the difference
• Invite your first team member
• From trial to paid plan — what changes
• Getting started with Wevion — complete guide