Resources / Permissions

Permissions and access control

Who can do what, who can see what, and who can delete what. The tables on this page come from the same authorization rules the product enforces.

Last verified against our product: October 4, 2026

Roles

Role	How it works
Admin	A per-organization flag. The first person to join an empty organization becomes its admin, and an existing admin can promote or demote others. The last admin cannot demote or delete themselves. A person who belongs to several organizations is an admin only in the ones where they hold the flag.
Member	Every other signed-in person with a profile in the organization. Members cannot see other organizations' data under any circumstance.
Reporting-line manager (a capability, not a role)	There is no separate manager role. If your org-chart position has direct reports, you can open a team connectivity view for exactly the people who report to you (Scale plan and above). It confers nothing else.

There is no moderator role, no read-only auditor role and no custom roles today. Job titles entered on profiles are free text and grant no permissions. The only support-initiated admin action built into the product is restoring an admin to an organization that has none, and it is recorded in the audit log.

How access is enforced

Every request is authenticated, and the caller's organization is resolved from their membership.
Admin-only actions are marked in the API itself and refused for anyone else.
Routes that take an organization id in the path check that it is the caller's own organization. Row Level Security in the database is a second, independent barrier.
Ownership checks (for example deleting your own video) are made in the database query. A request for something you do not own gets a not-found response, so the answer does not reveal that it exists.
Plan-gated features return a payment-required response rather than a permission error.

Role-by-capability matrix

People and invitations

Capability	Admin	Member	Notes
Bulk-invite people by email (up to 200 at a time)	Yes	No
Create and revoke join codes, approve or reject join requests	Yes	No
Join an organization with a code or request to join	Yes	Yes
Promote or demote an admin	Yes	No
Remove another member (immediate deletion of their account and videos)	Yes	No
View the member roster and colleague profiles	Yes	Yes	Includes email, title, bio, admin flag and last-active time. Excludes phone number.

Sign-in and provisioning

Capability	Admin	Member	Notes
Set MFA requirement, allowed sign-in methods and verified email domains	Yes	No	Scale plan and above.
Generate and rotate the SCIM token	Yes	No	Scale plan and above.

Integrations

Capability	Admin	Member	Notes
Connect or disconnect HRIS, Google Workspace, Microsoft 365, Slack and Teams	Yes	No
Connect or disconnect your own Google or Microsoft calendar	Yes	Own only	Per person. An admin cannot connect a calendar on someone else's behalf.

Videos and comments

Capability	Admin	Member	Notes
Record, upload, watch, like and comment	Yes	Yes
Delete a video	Yes	Own only	Members delete their own. Admins can delete anyone's.
Delete a comment	Yes	Own only
Edit another person's transcript or captions	Yes	No
Report a video or block a person	Yes	Yes
Review the moderation queue and hide a video	Yes	No

Groups and clubs

Capability	Admin	Member	Notes
Start a group, join a group you can see, leave a group	Yes	Yes	Growth plan and above. An admin can turn group creation off or require approval.
Approve, decline or remove a group	Yes	No	Admins see group names, organizers and member counts, never who is in an invite-only group.

Events

Capability	Admin	Member	Notes
Post a company event (a trip, an offsite)	Yes	Limited	Growth plan and above. Members the admin has added as event posters can; everyone else cannot.
Post an event for a group you organize, answer Going / Maybe / No	Yes	Yes	Group events are visible only to people who can see the group. A blocked person is neither listed nor counted.
Cancel an event	Yes	Own only	The poster or a group's organizer; admins can remove any event.

Questions

Capability	Admin	Member	Notes
Ask your group, team or company a question answered by video	Yes	Yes	Growth plan and above. An admin can turn member questions off or require approval, and can remove a question. Answers are visible only to the people the question reaches.

Organization settings

Capability	Admin	Member	Notes
Edit the org chart, Coffee Roulette and profile-sharing toggles, questionnaires	Yes	No
Report your own manager on your profile	Yes	Yes

Analytics and reports

Capability	Admin	Member	Notes
Organization Belonging metrics, aggregate analytics and the HR reports	Yes	No	Some views need a higher plan.
Per-manager rollups	Yes	No	Scale plan and above.
Team connectivity for your direct reports	Yes	Limited	Only for people who report to you; Scale plan and above.

Billing

Capability	Admin	Member	Notes
View plan and seat usage, change plan, open the billing portal	Yes	No

Your own data

Capability	Admin	Member	Notes
Edit your profile, name, role and bio	Yes	Yes	Name and role edits are audit-logged, and a directory sync does not overwrite them. Email is managed by your organization.
Export your own data	Yes	Yes
Delete your own account	Limited	Yes	The last admin cannot delete themselves.

Video visibility rules

Same organization only. Videos are visible only to signed-in people in the same organization. The database enforces this on every query, and a video id from another organization behaves as if it does not exist.
Published videos only. A video appears in feeds, search and playback only when it has finished processing, has not been hidden, has not been deleted, and its author has not been deleted. Deleting or offboarding a person therefore removes their videos from view at once.
Blocks work both ways. If you block someone, or they block you, neither of you sees the other's videos or comments.
No private or draft sharing mode. There is no per-video visibility setting. A published video is visible to the whole organization. Videos still processing, hidden by an admin, or deleted are not.
Playback links are signed, with a migration still in progress. Playback links are signed and issued per viewer for videos that viewer is allowed to see, and each one expires after 15 minutes. A viewer who is blocked, offboarded or looking at a hidden or deleted video is not issued one. We are mid-migration from an earlier unsigned playback address: it has not been retired for all existing videos, and a few secondary surfaces still return it. Hiding a video revokes its unsigned address (on a best-effort basis), and deleting a video removes the stored file. Anyone who already holds a valid address can play until it is revoked or expires, so treat video URLs as sensitive.
The public demo is separate. Videos recorded on the anonymous try-it page live in a separate demo space, never in a customer organization, and are deleted within 48 hours unless the person claims them into an account.

What admins can and cannot see about members

Can see

All non-deleted videos in their organization, including ones that are hidden or still processing, and their transcripts.
The moderation queue: reported videos and flagged comments, including who reported them.
Aggregate analytics: counts of members and videos, watches, completion rate and average watch time.
Belonging metrics: activation, connections per member, a connectivity index, recognition equity and 90-day cohort retention, mostly as organization-wide aggregates.
Per-manager rollups on the Scale plan and above: each manager's direct-report count, average connections and activation rate. There is no minimum group size, so a manager with one direct report effectively reveals that person's figures.
In the monthly HR report, a named list of top pairs of people who have not yet connected.

Cannot see

Who watched or liked a particular video. Engagement is shown to everyone as counts, plus your own reaction.
A per-person watch history. No screen returns one.
Another member's phone number.
Passwords or sign-in secrets. Those are held by our authentication provider.
Another organization's data, including organizations you also belong to under a different role.

Every member, not only admins, can see colleagues' email address, title, bio, whether they are an admin and when they were last active.
Many privileged actions (video deletion, removal, admin grants, invitations, SCIM provisioning, moderation and several organization settings) are written to an append-only audit log. It does not yet cover everything an admin can change: connecting or disconnecting an integration, generating a SCIM token and changing sign-in policy are not recorded in it today. There is no screen to read it; we can provide an extract on request.

Who can delete data

Action	Who	What happens	Permanent erasure
Delete a video	The author, or any admin	Disappears from the product immediately and its streaming link is revoked.	Permanently deleted, including the stored video file, 30 days later by a daily job.
Delete a comment	The author, or any admin	Hidden immediately.	Soft-deleted. No separate permanent-erasure schedule is published for individual comments.
Delete your own account	The member	Hidden everywhere immediately and signed out of the workspace. The last admin cannot do this.	Permanently erased within 30 days by a daily job, videos' stored files first. When no organization profile remains, that job then deletes the sign-in login at Clerk (retried if Clerk is unavailable).
Remove a member	An admin	Immediate deletion of the account and its videos, including the stored video files.	No grace period. Backups age out on their normal rotation.
Deprovision through SCIM	Your identity provider	Same as deleting your own account, and an employment-ended event is recorded.	Permanently erased within 30 days.
Whole organization on termination	We, on written request or termination	All organization data deleted, stored videos included, and integration connections revoked.	Within 30 days. This is a manual operator procedure today. Written confirmation on request.

Seat activation and access

There is no separate switch for activating a seat. A billed seat is a member who is not deleted and who has used the product in the last 90 days. The count is read from sign-in activity; nobody has to toggle it.
Billing is organization-wide and admin-only. Members cannot change seat status or see billing.
A member who has been inactive for 90 days stops being counted for billing but keeps full access. Nothing in the product locks out a quiet member.
Plan limits apply to joining, not to existing access. When a plan's seat cap is reached, new invitations and joins are refused; people already in are never removed by a cap.
If a trial ends or a plan is downgraded, plan-level features (for example SCIM or per-manager rollups) switch off, but existing members keep signing in.

Questions or a correction? [email protected]. See also: Security, Subprocessors, Privacy, Terms.