Role hierarchy and permission matrix

Reading this matrix

Section 17.2 introduces the three account tiers (Client, Partner, Enterprise) and their three role levels (superauditor, admin, superadmin), plus a summary of where a tier’s access differs from the general pattern. This section breaks that same information down per individual role, area by area, for all nine roles.

Two things from section 17.2 carry over unchanged here:

• Enterprise superadmin bypasses permission checks entirely and has unrestricted access across the whole platform, regardless of what the tables below show for that row.
• Scope still widens with tier — the “Full” or “Read” access shown below applies only within that role’s own scope (its own account, or its own account plus everything under it).

“Full” means read/write access. “Read” means read-only. “N/A” means the area is not visible in the sidebar for that role at all.

Client tier

Partner tier

Enterprise tier

Notes

• Public Drivers is available only to the single top enterprise role (superadmin) — not enterprise-admin, and not enterprise-superauditor — and only where your tenant has the feature enabled.
• Document 1 also flags an inconsistency in the backend’s internal role-ordering list: partner-superauditor and enterprise-superauditor rank above some higher-privilege roles in that list. This does not change the read/write access shown in the tables above — superauditor roles are read-only everywhere — but it may affect other hierarchy-dependent checks, such as which roles can be assigned when editing a user (see section 17.3).