User Roles & Permissions

Understanding authorization and access control in the platform

Introduction

Cnidarity implements a comprehensive permissions system to ensure secure collaboration across your research projects. The platform manages access control at two primary levels:

  • Workspace Level: Controls who can access a workspace and determine who can create or manage projects.
  • Project Level: Provides fine-grained control over what actions users can perform within specific projects.

This hierarchical approach ensures that research teams can collaborate efficiently while maintaining data integrity and security.

Users must first be members of a workspace before they can be added to any projects within that workspace.

Workspace Roles

At the workspace level, there are two distinct roles with clearly defined permissions:

Workspace Owner

Each workspace has exactly one owner who has full administrative control:

  • Create new projects within the workspace
  • Invite users to the workspace
  • Remove users from the workspace
  • Edit workspace details and settings
  • Manage workspace subscription and billing
  • Delete the workspace

The workspace owner automatically has full access to all projects within the workspace, regardless of whether they've been explicitly added to those projects.

Workspace Guest

All other users invited to a workspace are considered guests with limited permissions:

  • View the workspace
  • Access projects they've been specifically invited to
  • Cannot create new projects
  • Cannot invite other users to the workspace
  • Cannot modify workspace settings

Workspace guests can only access projects they've been explicitly added to, with permissions defined by their project-level role.

Only the workspace owner can create new projects or invite users to the workspace. This ensures centralized control over workspace resources and membership.

Project Roles

At the project level, user permissions are more granular, allowing for precise control over access to research data. Workspace members can be assigned one of three project roles:

Project Admin

Project Administrators have comprehensive control over the project:

  • Create, modify, and delete data models
  • Create, modify, and delete attributes
  • Create, modify, and delete model relationships
  • Create, modify, and delete records (data entries)
  • Manage project settings
  • Add users to the project
  • Change user roles within the project

Project Admins can add users from the same workspace to the project, but cannot invite external users to the workspace.

Regular User

Regular Users can work with data but cannot modify project structure:

  • Create, modify, and delete records (data entries)
  • View models and attributes
  • Cannot modify models or attributes
  • Cannot modify relationships
  • Cannot change project settings
  • Cannot manage users

Regular Users are ideal for team members who need to input and edit research data but shouldn't alter the underlying data structure.

View Only

View Only users have read-only access to project data:

  • View records and their data
  • Cannot create, modify, or delete any records
  • Cannot create, modify, or delete models
  • Cannot create, modify, or delete attributes
  • Cannot create, modify, or delete relationships

View Only access is appropriate for stakeholders who need to see research data but shouldn't make any changes.

All user roles in a project (other than the Workspace Owner) are bound by the permissions of their assigned role. For example, a Project Admin cannot perform actions that are restricted to the Workspace Owner, such as deleting the workspace or inviting new users to the workspace.

Role Privileges Comparison

The following table provides a detailed comparison of permissions for each role in the platform:

PermissionWorkspace OwnerWorkspace GuestProject AdminRegular UserView Only
Workspace Level
View Workspace
Edit Workspace
Delete Workspace
Create Projects
Invite Workspace Users
Remove Workspace Users
Project Level
Create Models
Update Models
Delete Models
Create Attributes
Update Attributes
Create Records
Update Records
Delete Records
View Records
Manage Project Users
Update Project Settings

Note that Workspace Guests have no inherent project permissions. They gain access to projects only when explicitly assigned a project role (Admin, Regular, or View Only).

This permission structure ensures that workspace owners maintain control over the overall research environment, while project-level roles provide the flexibility needed for different types of collaboration within specific research projects.

Best Practices

Follow these recommendations for effective user role management in your research platform:

Use the Principle of Least Privilege

Always assign users the minimum level of access they need to perform their tasks. This reduces the risk of accidental data modification or deletion.

Plan Your Role Structure

Before inviting team members, plan out what roles they should have in each project. Consider their responsibilities, technical expertise, and need for access to sensitive data.

Limit Project Admins

Restrict Project Admin roles to team members who need to manage the project structure. Too many admins can lead to uncoordinated changes in your data models.

Use View Only for External Stakeholders

For stakeholders who need to see research progress but shouldn't modify data (like funding agencies or external reviewers), the View Only role is ideal.

Regularly Review Access

Periodically review who has access to your workspaces and projects, and at what permission levels. Remove users who no longer need access and adjust roles as team responsibilities change.

Train Users on Their Permissions

Ensure your team members understand what they can and cannot do with their assigned roles. This prevents frustration and reduces support requests when they encounter permission restrictions.

For large research teams, consider creating a documentation reference that outlines which team members have what level of access to different projects, along with the rationale for each assignment.