Permissions
Permissions in Docwize decide which features, apps and actions a user or group can use. They are separate from document-level access, which is managed through Access Control: a permission adds a control to the Portal, and access decides which folders, projects and documents that control works on.
Permissions can be given to a group, so that every member has them, or to one user.
Who configures this
Users with the Group and User Admin permission and the Admin Console licence. Permissions are changed in the Permissions tab of a group's or a user's Settings dialog in the Admin Console.
What you can do with permissions
- Give a group a permission, so that every member gets it (Admin Console > Groups).
- Give one user a permission of their own (Admin Console > Users).
- Read what each permission does, in the Permissions panel and in the permission reference.
- See which permissions a user gets from their groups.
How permissions work
Group permissions are the foundation. When you tick a permission in a group's Permissions tab, every user in the group has it at once, and so does everyone who joins later. Because a group can stand for a role, this is the most scalable way to manage permissions.
User permissions are added on top of the groups for the rare person who needs something their groups do not give. Tick them in the Permissions tab of the user's Settings dialog.
A permission that comes from a group is shown in grey in the user's Permissions tab, ticked and unavailable. To change it, change it in the group, which changes it for every member.
A user's Permissions tab: permissions from the user's groups (grey), and one of the user's own
A user may belong to several groups. Their effective permissions are those of all their groups plus the ones ticked for the user.
note
Permissions decide what a user can do. They do not decide which folders, projects or documents the user can reach, which Access Control manages. A user may be able to create documents and still be unable to open a folder they have no access to.
The Permissions panel
The Permissions tab is in the Settings dialog of both a group and a user. Open it from Groups or from Users, with the gear icon in the row, then select Permissions in the left-hand navigation.
A group's Permissions tab
The tab opens with a hint, Toggle permissions for this group. Changes apply to all members, and lists the permissions in nine sections: Administration and Security, Explorer and Views, Documents and Office, Workflows, Projects, Contacts, Metadata and Interfaces, Tools and Integrations. Ticking or unticking a permission saves it at once.
Hover a permission to read the description the Portal gives it. The reference below starts from those descriptions and adds where the permission shows up.
The description of a permission, shown when you hover it
Permission reference
The table follows the panel's sections. The Description column gives the Portal's own description, then where the permission shows up and the page that explains the feature.
| Section | Permission | Description |
|---|---|---|
| Administration and Security | Group and User Admin | Allows managing users, groups, licences and permissions: the Users and Groups pages and every access grant they make need it. The Admin Console licence opens the Admin Console, but without this permission it cannot manage them. Also needed to grant access to a document or a register row, and it adds the Calculate Routing Configs tile to New. |
| Access Token Generation | Create access tokens for the API. Adds API Key Management to New, where API keys are created. See API Key Management. | |
| View Audits | Allows viewing audit history for documents and other entities. Adds the View Audit History icon to the header of Document Details and of a contact, and View version history to the header of a custom field. See Document Details. | |
| Manage System Config | Allows System Config to be opened in the Admin Console and company-wide defaults to be set, such as the default columns and ordering of the document grids, and the tag recommendation settings in Tag Management. Held by the Administrators group. | |
| Forge - Manage Code | Manage Forge source packages and view functions. Does not grant deployment authority. Adds the Forge tile to Workflow Setup in New (the section itself needs Workflows - Create Template). See Docwize Forge. | |
| Explorer and Views | Create Folders | Allows the user to create folders in Explorer. Adds Create New Folder at the top of the folder tree, Create new subfolder to a folder's right-click menu and Bulk Upload Folder to the New menu of a folder. See Folders. |
| Delete Folders | Allows the user to delete folders in Explorer. Adds Delete folder to a folder's right-click menu. Deleting a folder deletes its subfolders and documents too. See How to delete a folder. | |
| View Folders | Allows the user to view folders in Explorer. Shows the Folders tab. Which folders it lists depends on folder access. See Folders. | |
| View Locations | Adds the Locations tab to Explorer, where locations are also created, edited and deleted. See Locations. | |
| View Folder Views | Adds the Folder Views tab to Explorer, which holds the virtual folders. See Virtual Folders. | |
| View Tag Tree | Adds the Tags tab to Explorer, with its Manage Tags button. See Tags. | |
| Reports | Adds dataviews to Explorer, in the Reports tab. See Dataviews. | |
| View Interfaces | Lists the interfaces the user has access to in the Reports tab of Explorer, and shows that tab even without the Reports permission. See Interfaces. | |
| View Dashboards | Adds the Analytics tab to Explorer, with workflow reporting and aggregate charts. See Analytics. | |
| Documents and Office | Create Documents | Allows the user to create documents. Adds the Documents and Records sections to New, the New menu of a folder, and Extract (ZIP/PST) for archive files. See Upload/Create New Docs. |
| Delete Self Owned Documents | Allows the user to delete documents that they own. Adds Delete to a document's right-click menu and Delete Document to Document Details. See Document Details. | |
| Delete Other Users Documents | Allows the user to delete documents that are not owned by them. It shows the same Delete controls and applies to documents owned by anyone. | |
| Document Permissions | Allows the user to view and set document permissions per document. It also needs Group and User Admin: Permissions in a document's right-click menu, which opens the Document Permissions dialog, is offered to users who hold both. See Access Control. | |
| Unlock Documents | Allows unlocking a document's custom field templates that a workflow's Custom Field Locks step has locked, from the lock icon on the template in the Custom Fields tab of Document Details. See Custom Fields. | |
| Documents - Manage Review Schedules | Allows configuring document review schedules, bulk review setup, folder and document-type defaults, and automatic review policies. Adds Review Setup to Workflow Setup in New, the Review tab of the Assign dialog, Set up review to the right-click menu and the Review automation tab to a folder's properties. See Review Setup. | |
| Enable WOPI | Shows View In Office Online on Office documents: in the right-click menu of Office files and in Office Options in the viewer. Saving changes made in Office Online needs this permission and a file edit grant on the document. See Document Preview. | |
| Enable WOPI Editing | Allows the user to edit Office documents in the browser. With it the same menu entries read Edit In Office Online. | |
| Can Translate | Allows the user to translate documents. Starting a translation, and burning a finished translation into a new document, need it. Adds the Translations icon to the viewer toolbar, next to the other review tools (Review Document). See Document Preview. | |
| Enable Auto Redaction | Allows the user to generate proposed redaction annotations from a prompt the user writes. The proposals are annotations: they are not burned into the document. Adds the Auto Redact tool to the viewer's annotation tools (Review Document too). See Redaction. | |
| Review Document | Allows the user to bulk assign documents, and to add annotations, notes and tags to documents. In the viewer it shows the annotation tools, the Annotations, Notes and Tags panels and the Document Details, Attachments and Translations buttons and the download icon. In grids it adds Document details, Attachments, Workflow, File Versions, Action Requests and Update Details to the right-click menu, and the Assign dialog. See Annotations, Notes, Tags and Assigning Docs. | |
| Workflows | Workflows - Create Template | Allows the user to create workflow templates. Adds Workflow Setup to New (Actions and Templates) and the icon of the floating toolbar, which opens the Template Shortcut Builder. See Building Workflow Templates. |
| Workflows - Monkey Patch | Allows the user to change node settings on a live workflow, for example fixing a wrong URL on an API node so that a stuck workflow can continue. Changes apply at once to every workflow using that template, including ones already running. Adds the Edit node settings button to a system task in the Inbox. Without the permission the button is not shown and the Portal refuses the change. See Building Workflow Templates. | |
| Workflows - View All | Allows the user to view workflows in a document's details. Shows the Workflows tab of Document Details for every workflow on the document, and the All org workflows option in Analytics. See Workflows. | |
| Workflows - Project Admin | Allows the user to view workflows whose document is in a project the user has read access to, even if the user did not create, send or receive them. Shows the Workflows tab of Document Details for those workflows. See Workflows. | |
| Workflows - Revoke Any | Allows the user to revoke workflows. Adds Revoke Workflow and Force Close Workflow to the workflow menu in the Inbox, and Cancel action and Send reminder to the menu of an action request. See Completing Action Requests. | |
| Workflows - Modify Action Recipient | Allows the user to modify the recipient of a workflow action request. Replace user in the Inbox needs this permission together with Workflows - Revoke Any. See Completing Action Requests. | |
| Workflows - Create Global Filter | Allows the user to add inbox filters for everyone. Adds the Sharing tab to the view builder of the Inbox and of Analytics. See Left Sidebar. | |
| Workflows - Set Company Default View | Allows the user to choose the Inbox view that opens by default for every user in the company. Adds a building icon to each view in the Inbox views list, with a Company default badge on the chosen view. See Left Sidebar. | |
| Replay Workflow | Allows the user to retry tasks and action requests in workflows. Adds Replay action to an action request's menu and Retry to a system task that failed. See Inbox. | |
| Undo Actions Taken | Allows the user to undo actions taken in workflows. It is offered in the Workflows app. | |
| Use Legacy Signatures | Signs with a stamp when the user signs in a workflow, and adds the Signature Text tool to the viewer. See Digital Signing. | |
| Workflows - Assign External | Allows assigning external (flexi) users to workflow actions by email invitation. When a workflow is started, its user input then accepts an email address and asks for an external group. See Workflows. | |
| Adhoc Action Requests | Allows adding ad hoc action requests to workflow items. Adds Add Action Request to the User Tasks tab of the Inbox. See Inbox. | |
| Projects | View Project Details | Needed to view project details or list all projects. See Projects. |
| Create Project | Allows the user to create projects. Adds Projects (Manage Projects) to New. See Projects. | |
| Edit Project | Allows the user to edit projects. Adds Edit Project to a project's row menu in Manage Projects. See Projects. | |
| Delete Project | Allows the user to delete projects. Adds Delete Project to a project's row menu in Manage Projects. See Projects. | |
| Project Permissions | Required for the user to change Project permissions in the Admin Console. Without it, the Projects tab of a group's or a user's Settings dialog shows the project access but cannot change it. See Projects. | |
| Contacts | View Contacts | Allows the user to view contacts and organizations. See Contacts & Organisations. |
| Create Contacts | Allows the user to create contacts. Adds Contacts & Organizations to New. See Contacts & Organisations. | |
| Edit Contacts | Allows the user to edit contacts and organizations. See Contacts & Organisations. | |
| Metadata and Interfaces | Lookup Lists | Adds the Add new Item icon beside lookup fields, such as the document type, in Document Details, the New Document dialog and the Assign dialog. It also allows managing lists, tags and document templates. See Manage Lists. |
| Manage Document Custom Fields | Adds Custom Fields & Configuration to New, which holds Custom Fields, Manage Records, Manage Registers and the other configuration tiles. See Custom Fields. | |
| Default extraction config | Allows the user to configure the default upload extraction settings. Adds the Default Upload Extraction tile to Custom Fields & Configuration. See Default Upload Extraction. | |
| Dataview Settings | Allows the user to change dataview settings and notes. Adds the Dataview settings gear to each dataview in the Reports tab of Explorer. See Dataviews. | |
| Create Email Rules | Allows the user to create rules that route incoming emails automatically, set metadata or start workflows. Adds the Influx Builder tile to Custom Fields & Configuration, with its Email rules tab. See Email Influx. | |
| Manage Interfaces | Allows the user to create and edit interfaces and their components. Adds the Interface Builder and Chart Builder tiles to Custom Fields & Configuration. See Interface Builder. | |
| Manage Plugins | Allows the user to work with plugin configuration packages. Adds Plugins to New, where packages are imported (Import Plugin) and the installed ones are listed (Installed Plugins). | |
| Tools | Can Chat | Adds the Oliver chat to the floating toolbar, the Oliver section to the user's settings and the AI Agents Configuration section to New. See Oliver Chat. |
| Can Edit System Agents | Allows editing and deleting Oliver's system agents, choosing the default agent, managing agent tools, and changing the Oliver chat defaults. Adds the Oliver chat defaults tile to AI Agents Configuration. See Agent Configurator. | |
| Can Buckets | Allows the user to create and use buckets in the notification bar. Adds the Bucket Menu icon to the floating toolbar. See Buckets. | |
| Manage Company Signatures | Allows the user to set the company-wide look of signatures: stamps, text and images available to all users. Opens the Signature Editor from Edit Signature Appearance in the viewer's signature menu. See Digital Signing. | |
| Manage Tours | Allows creating and editing product tours. Adds Create Tour and Manage All Tours to the Help Center menu, and an edit pencil to each tour. | |
| Tag Recommendations | Enables AI-powered tag recommendations in the document viewer, based on similar documents and workspace usage. Adds the recommendations (sparkle) button to the Tags tab of the viewer; each user then turns the suggestions on there. See Tag recommendations. | |
| Integrations | Manage Connectors | Allows configuring third-party connectors such as SharePoint sync. Adds Third Party Connectors to New (SharePoint Connectors, GitHub Connectors, freee HR). See SharePoint Connectors and freee HR. |
How to give a group a permission
Giving a group a permission
| Step | Description |
|---|---|
| 1 | Go to Admin Console > Groups and select the gear icon in the group's row. |
| 2 | Select Permissions in the left-hand navigation. |
| 3 | Hover a permission to read its description. |
| 4 | Tick the permission. It is saved at once and applies to every member. |
| 5 | Untick it to take it away from every member again. |
How to give a user a permission
| Step | Description |
|---|---|
| 1 | Go to Admin Console > Users and search for the user. |
| 2 | Select the gear icon in the user's row, then Permissions in the left-hand navigation. |
| 3 | Tick the permission. It is saved at once. A permission shown in grey comes from one of the user's groups and cannot be changed here. |
How to see where a user's permissions come from
| Step | Description |
|---|---|
| 1 | Open the user's Settings dialog from Admin Console > Users and select Permissions. |
| 2 | A permission that is ticked and in grey comes from one of the user's groups. A ticked permission you can untick was given to the user directly. |
| 3 | To find the group, select Details and read the Groups panel, then open each group's Permissions tab. |
Before changing permissions
Change permissions at group level where possible. A permission given to a group applies at once to all current and future members. User permissions are harder to audit and maintain at scale, so use them only for genuine exceptions.
Understand what a permission gives before you tick it. Some permissions are broad. Group and User Admin lets a user administer every user and group in the Admin Console. Delete Other Users Documents applies to documents owned by anyone in the organisation.
Remember that permissions and document access are separate. Giving a permission such as Create Documents or View Interfaces does not give access to particular documents, folders or projects. That is managed in Access Control.
Check what a user already gets from their groups before you give a user permission. If a group already gives it, a user permission is redundant. To take away a permission a group gives, change it in the group.
Coordinate group changes with anyone who manages the group. Changing a group permission affects every member at once.
What to check
| Situation | How it typically happens | What to check |
|---|---|---|
| Permission given to the wrong group | An administrator edits a group without checking all its members | Review the full membership of a group before changing its permissions |
| A user has more than intended | The user is in several groups and their permissions add up | Check all of the user's groups, not just the main one |
| High-impact permissions given to a whole group | Delete Other Users Documents, Delete Folders or Workflows - Revoke Any given to a whole group | Keep high-impact permissions for small, trusted groups or specific users |
| Permissions confused with document access | A permission is given but the user still cannot see documents | Check folder and project access separately in Access Control |
| A group permission cannot be removed in the user's panel | An administrator tries to untick a grey permission in the user's panel | Change the permission in the group, which changes it for all its members |
Testing permission changes
Before you apply a change in a live environment:
- Identify a test user account with the same group memberships as the affected users.
- Apply the intended permission change, in the group or for the user.
- Sign in as the test user, or ask a trusted colleague with that account, and check:
- Can they use the features they should now have?
- Are they blocked from features they should not have?
- Does the change behave as expected in both directions?
- For a group change, confirm it has not affected other members of the group.
Related configuration
- Users — create accounts, assign groups and give user permissions
- Groups — create and manage groups, and give them permissions and folder access
- Access Control — folder security, project security and document-level access, separate from permissions
- Admin Console — overview of all Admin Console areas
- Digital Signing — the signing workflow, whose appearance Manage Company Signatures sets