Product roles and delegated permissions¶

A product licence, organization-administrator status and a workspace role answer different questions. A licence provides product eligibility; an active assigned role contributes permitted actions; organization administration supplies separately controlled responsibilities. Account, membership, commercial and resource checks still apply.

Use Create and manage workspace roles for the intended role-management journey, inactive creation, activation, editing and the limitations of Current people. Use the People guide for staff role assignments and the membership guide for organization membership. Those guides distinguish the final designs from the unfinished frontend.

Permissions remain specific to each product¶

Workforce role data supplies the inspected WorkOS and HiveOrbit permission readers and the HiveAI permission-request consumer. Each product receives permissions recognized by its own catalogue. A permission belonging to one product does not automatically become permission in another product.

Zerohive combines relevant permissions from active assigned roles. It does not interpret an unknown permission label as unrestricted access. Role definitions do not purchase licences, activate a subscription or bypass restrictions on individual records. HiveAI governance and tenant knowledge administration have additional controls described in the permission guide.

Changing a job title, an organization-administrator designation or a product licence is not the same operation as changing staff role assignments. A person may receive the same action from several active roles or from separate administrator authority. Removing one source does not prove the action has disappeared.

A saved change and effective access are separate checks¶

Role and assignment changes request invalidation of cached permissions. Publication, cache removal, a new signed permission set and the next authorized action are separate stages. An already-open session may not reflect a change immediately. See permission cache behavior.

When an expected action is missing, check the correct organization and product, licence status, assigned roles, role activation and the permission needed for that action. If those appear correct, distinguish stale session information or a service failure from a genuine permission denial. Use the role recovery guidance to reconcile an uncertain management change.

For managers, the practical review is whether people can perform their intended responsibilities under the correct product and record restrictions. A role's people panel is not a complete access certification or full affected-person list; the WorkOS guide explains why. Confirm effective access through the organization's authorized process.