Roles & Permissions

Flowstate uses role-based access control (RBAC) to govern what users can see and do across the platform. Users are assigned roles, and each role contains a set of permissions that determine access to specific features and data.

Overview

The RBAC model has three layers:

Layer	Scope
Organization Roles	Assigned to a user at the organization level via a Role
Team-Level Access	Line managers receive implicit permissions for their teams
Direct User Grants	Individual permissions granted directly to a user

Permissions are additive -- a user's effective permissions are the union of all permissions from their role, team-level access, and any direct grants.

Roles

A role is a named collection of permissions. Roles are managed in Settings → Users & Access → Roles and have the following properties:

Field	Description
name	Display name for the role (e.g., "Administrator", "Viewer", "Financial Manager")
description	A short explanation of the role's purpose
isSystem	Whether this is a built-in system role (cannot be deleted)
isTenantAdminOnly	Whether this role is restricted to tenant administrators
dashboardViewMode	Default dashboard view mode for users with this role (defaults to INSIGHTS)

System Roles

System roles are built into Flowstate and cannot be deleted. They serve as baseline templates and cover the most common access patterns. You can identify them by the isSystem flag.

System Role	Purpose
Administrator	Full access to all features and settings
Config Admin	Full settings access, team and roadmap management, no financial visibility
Financial Manager	Full financial visibility and team management with compensation control
Team Manager	Team and roadmap management without financial visibility
Line Manager	Team-scoped financial visibility and management, effort approval
Team Member	View access to non-financial data, can submit effort tracking
Viewer	Read-only access to non-financial data
AI Viewer	AI-only end user; sees only their personal AI usage page

TIP

Use system roles where they fit your organization's needs. Create custom roles only when you need a permission combination that no system role provides.

Custom Roles

Create custom roles to match specific job functions in your organization. For example, you might create a "Finance Analyst" role with read access to financial details and forecasts but no ability to modify employee records.

1. Navigate to Settings → Users & Access → Roles
2. Click Create Role
3. Enter a name and description
4. Select the permissions for this role (see Permission Reference below)
5. Click Save

Managing roles requires the SETTINGS_RBAC_* permissions:

Action	Permission
View roles	SETTINGS_RBAC_VIEW
Create roles	SETTINGS_RBAC_CREATE
Update roles	SETTINGS_RBAC_UPDATE
Delete roles	SETTINGS_RBAC_DELETE

WARNING

Deleting a custom role removes it from all users who currently have it assigned. Affected users lose those permissions immediately. Reassign them to a different role before deleting.

Permission Reference

Permissions are organized by functional area. Each permission controls access to a specific action or set of actions within that area.

Settings -- Entity Configuration

Control access to organizational entities such as teams, work types, value streams, cost centres, and other configuration data.

Permission	Description
SETTINGS_ENTITY_CONFIG_VIEW	View entity configuration settings
SETTINGS_ENTITY_CONFIG_CREATE	Create new entity configuration entries
SETTINGS_ENTITY_CONFIG_UPDATE	Modify existing entity configuration
SETTINGS_ENTITY_CONFIG_DELETE	Delete entity configuration entries

Settings -- Financial Configuration

Control access to financial settings including currencies, exchange rates, and cost parameters.

Permission	Description
SETTINGS_FINANCIAL_CONFIG_VIEW	View financial configuration settings
SETTINGS_FINANCIAL_CONFIG_CREATE	Create financial configuration entries
SETTINGS_FINANCIAL_CONFIG_UPDATE	Modify financial configuration entries
SETTINGS_FINANCIAL_CONFIG_DELETE	Delete financial configuration entries

Settings -- Data Import

Permission	Description
SETTINGS_DATA_IMPORT	Import data from external sources

Settings -- RBAC

Control who can manage roles and permissions themselves.

Permission	Description
SETTINGS_RBAC_VIEW	View roles and their permissions
SETTINGS_RBAC_CREATE	Create new roles
SETTINGS_RBAC_UPDATE	Modify existing roles
SETTINGS_RBAC_DELETE	Delete roles

Settings -- User Invitations

Permission	Description
SETTINGS_USERS_INVITE	Invite new users to the organization

Settings -- Integrations

Control access to integration settings such as project management sync (Azure DevOps, Linear, Jira). API keys, SCIM provisioning, SIEM, and webhooks have their own permission families (see below).

Permission	Description
SETTINGS_INTEGRATIONS_VIEW	View integration configurations
SETTINGS_INTEGRATIONS_CREATE	Create new integrations
SETTINGS_INTEGRATIONS_UPDATE	Modify existing integrations
SETTINGS_INTEGRATIONS_DELETE	Delete integrations

Financial Detail

Control the level of financial information visible to the user.

Permission	Description
FINANCIALS_VIEW_SUMMARY	View aggregated financial summaries (team/project level)
FINANCIALS_VIEW_DETAILED	View individual salary, contractor rate, and cost data

WARNING

FINANCIALS_VIEW_DETAILED grants access to individual compensation data. Assign this permission only to users who need it for their role, such as finance leads and HR business partners.

Team Plan -- Employees

Permission	Description
TEAM_EMPLOYEES_VIEW	View employee records and allocations
TEAM_EMPLOYEES_CREATE	Create new employee records
TEAM_EMPLOYEES_UPDATE	Modify employee records and allocations
TEAM_EMPLOYEES_DELETE	Remove employee records
TEAM_EMPLOYEES_MODIFY_COMPENSATION	Change employee salary and compensation
TEAM_EMPLOYEES_BULK_MODIFY_COMPENSATION	Apply one salary change to every employee matching a filter in a single bulk operation

Team Plan -- Teams

Permission	Description
TEAM_TEAMS_VIEW	View team structure and membership
TEAM_TEAMS_CREATE	Create new teams
TEAM_TEAMS_UPDATE	Modify team details and structure
TEAM_TEAMS_DELETE	Delete teams

Team Plan -- Global Permissions

Permission	Description
ALL_TEAMS_VISIBILITY	See people and the cost forecast across every team in the organisation (includes LIST_ALL_TEAMS)
LIST_ALL_TEAMS	Browse and select any team in team lists and pickers, without seeing other teams' people or cost

Team Plan -- Contractors

Permission	Description
TEAM_CONTRACTORS_VIEW	View contractor records
TEAM_CONTRACTORS_CREATE	Create new contractor records
TEAM_CONTRACTORS_UPDATE	Modify contractor records
TEAM_CONTRACTORS_DELETE	Remove contractor records
TEAM_CONTRACTORS_MODIFY_COMPENSATION	Change contractor rates and compensation
TEAM_CONTRACTORS_BULK_MODIFY_COMPENSATION	Apply one rate change to every contractor matching a filter in a single bulk operation

Team Plan -- Vacancies

Permission	Description
TEAM_VACANCIES_VIEW	View vacancy records
TEAM_VACANCIES_CREATE	Create new vacancy records
TEAM_VACANCIES_UPDATE	Modify vacancy records
TEAM_VACANCIES_DELETE	Remove vacancy records
TEAM_VACANCIES_MODIFY_COMPENSATION	Change vacancy target salary and compensation
TEAM_VACANCIES_BULK_MODIFY_COMPENSATION	Apply one target-salary change to every vacancy matching a filter in a single bulk operation

Team Plan -- Skills

Permission	Description
TEAM_SKILLS_VIEW	View skills and competency data
TEAM_SKILLS_CREATE	Create new skill definitions
TEAM_SKILLS_UPDATE	Modify skill definitions
TEAM_SKILLS_DELETE	Delete skill definitions

Roadmap -- Projects

Permission	Description
ROADMAP_PROJECTS_VIEW	View projects and project details
ROADMAP_PROJECTS_CREATE	Create new projects
ROADMAP_PROJECTS_UPDATE	Modify project details
ROADMAP_PROJECTS_DELETE	Delete projects

Roadmap -- Initiatives

Permission	Description
ROADMAP_INITIATIVES_VIEW	View initiatives
ROADMAP_INITIATIVES_CREATE	Create new initiatives
ROADMAP_INITIATIVES_UPDATE	Modify initiatives
ROADMAP_INITIATIVES_DELETE	Delete initiatives

Roadmap -- Drivers

Permission	Description
ROADMAP_DRIVERS_VIEW	View strategic drivers
ROADMAP_DRIVERS_CREATE	Create new drivers
ROADMAP_DRIVERS_UPDATE	Modify drivers
ROADMAP_DRIVERS_DELETE	Delete drivers

Cost Forecast

Permission	Description
FORECAST_VIEW	View cost forecasts and financial models
BUDGET_SNAPSHOT_CREATE	Freeze the current forecast as a budget baseline for a fiscal year

Scenario Plans

Permission	Description
SCENARIOS_USE	Create, manage, and submit scenario plans for review
SCENARIOS_EDIT	Modify data within draft scenario plans
SCENARIOS_MODIFY_COMPENSATION	Modify compensation within a draft scenario or budget proposal
SCENARIOS_MERGE	Merge scenario plan changes into live data

Effort Tracking

Permission	Description
EFFORT_VIEW	View effort tracking data and reports
EFFORT_SUBMIT	Submit effort tracking entries
EFFORT_OVERRIDE	Override effort tracking entries
EFFORT_APPROVE	Approve effort tracking submissions
EFFORT_CONTRACTOR_VIEW	View contractor effort tracking data
EFFORT_CONTRACTOR_MODIFY	Edit contractor effort tracking entries

Audit

These permissions gate the finance audit-evidence feature (for example, capitalisation evidence for your auditors).

Permission	Description
AUDIT_VIEW	View audit evidence and reports
AUDIT_CONFIGURE	Configure audit criteria and settings
AUDIT_CONFIRM	Confirm and validate audit evidence
AUDIT_EXPORT	Export audit-ready reports

INFO

The Activity Log (the change feed at Settings → Organisation → Activity Log) is separate from this feature. It is gated by the SETTINGS_SIEM_VIEW permission.

Settings -- API Keys

Permission	Description
SETTINGS_API_KEYS_VIEW	View API key list and metadata
SETTINGS_API_KEYS_CREATE	Generate new API keys for REST API access
SETTINGS_API_KEYS_DELETE	Revoke existing API keys

Settings -- Auth Providers

Permission	Description
SETTINGS_AUTH_PROVIDERS_VIEW	View authentication provider configurations
SETTINGS_AUTH_PROVIDERS_CREATE	Create new authentication provider configurations
SETTINGS_AUTH_PROVIDERS_UPDATE	Modify authentication provider configurations and group mappings
SETTINGS_AUTH_PROVIDERS_DELETE	Remove authentication provider configurations

Settings -- SIEM Integration

Permission	Description
SETTINGS_SIEM_VIEW	View SIEM endpoint configurations (also grants access to the Activity Log)
SETTINGS_SIEM_CONFIGURE	Create, update, and delete SIEM endpoints

Settings -- SCIM Provisioning

Permission	Description
SETTINGS_SCIM_VIEW	View SCIM tokens, group mappings, and provisioned users
SETTINGS_SCIM_CONFIGURE	Create and revoke SCIM tokens, manage group-to-role mappings

Settings -- Webhooks

Permission	Description
SETTINGS_WEBHOOKS_VIEW	View webhook endpoint configurations and delivery logs
SETTINGS_WEBHOOKS_CONFIGURE	Create, update, delete, and test webhook endpoints

R&D Tax Relief

Permission	Description
RD_TAX_VIEW	View R&D tax relief claims, qualifying activities, and reports
RD_TAX_CREATE	Create new R&D tax relief claims
RD_TAX_UPDATE	Modify R&D tax relief claims
RD_TAX_DELETE	Remove R&D tax relief claims
RD_TAX_APPROVE	Approve and finalise R&D tax relief claims for submission
RD_TAX_EXPORT	Export R&D tax relief reports and supporting documentation
RD_TAX_SCANNER_CONFIGURE	Configure R&D tax relief scanner rules and qualifying criteria

Budget Requests & Proposals

Permission	Description
BUDGET_REQUEST_VIEW	View budget requests and proposals
BUDGET_REQUEST_VIEW_TEAM	View budget requests and proposals for managed, assigned and approved teams only
BUDGET_REQUEST_CREATE	Initiate budget cycles
BUDGET_PROPOSAL_EDIT	Edit proposals for assigned teams
BUDGET_PROPOSAL_SUBMIT	Submit proposals for approval
BUDGET_PROPOSAL_APPROVE	Approve submitted proposals
BUDGET_PROPOSAL_MERGE	Merge approved proposals to live
BUDGET_REQUEST_LOCK	Lock budget (financial approval)
BUDGET_CONFIG_VIEW	View budget configuration
BUDGET_CONFIG_UPDATE	Configure budget approval rules

AI Governance

Permission	Description
AI_POLICY_ADMIN	Author AI policies, read the enforcement feed, override consequence tiers, and download evidence packs

AI Fluency

Permission	Description
AI_FLUENCY_VIEW_INDIVIDUAL_SCORES	View per-employee AI Fluency scores across the whole organisation

AI Telemetry Keys

Permission	Description
AI_TELEMETRY_KEYS_MANAGE	Create, revoke, and bulk-provision AI telemetry keys for other users

Assigning Roles to Users

Manual Assignment

1. Navigate to Settings → Users & Access → Users
2. Click on the user you want to modify
3. Under Role, select the desired role from the dropdown
4. Click Save

Changing a user's role requires the SETTINGS_RBAC_UPDATE permission.

Group-to-Role Mapping (SSO)

When using SAML 2.0 or OAuth 2.0 for authentication, you can map identity provider groups directly to Flowstate roles. This allows you to manage Flowstate access from your IdP rather than configuring roles individually in Flowstate.

IdP Group Name	Flowstate Role	Effect
Flowstate-Admins	Administrator	Full access including all settings
Flowstate-Managers	Team Manager	Team and roadmap management, no financial visibility
Flowstate-Viewers	Viewer	Read-only access to non-financial data

Configure group-to-role mappings in the auth provider settings:

• SAML group-to-role mapping
• OAuth group claims configuration

When a user authenticates via SSO, Flowstate evaluates their IdP group memberships against the configured mappings and assigns the appropriate role.

WARNING

If a user belongs to multiple mapped groups, they receive the highest-privilege role. For example, membership in both Flowstate-Viewers and Flowstate-Admins results in the Administrator role being assigned.

SCIM Provisioning

When SCIM 2.0 provisioning is enabled, group membership changes in your IdP are automatically synced to Flowstate. Adding a user to a mapped group in your IdP updates their Flowstate role without manual intervention.

See the SCIM group-to-role mapping guide for details.

Team-Level Access

Line managers receive implicit permissions for the teams they manage. This allows managers to view and manage their direct reports without requiring organization-wide permissions.

Team-level access is determined by the team's manager assignment in Flowstate and does not require a separate role configuration.

Best Practices

1. Follow the principle of least privilege -- Assign users the minimum permissions required for their job function. Start with a restrictive role and add permissions only as needed.
2. Use system roles where possible -- System roles cover common access patterns and are maintained by Flowstate. Custom roles require ongoing maintenance as new permissions are added.
3. Create custom roles for specific job functions -- If you have distinct job functions that do not map cleanly to a system role, create a custom role. Name it after the job function (e.g., "Finance Analyst", "Engineering Manager") rather than the permissions it contains.
4. Use SSO group mapping -- If you use SAML or OAuth, manage role assignments through your IdP groups rather than manually in Flowstate. This ensures role changes follow your existing access governance processes.
5. Review role assignments periodically -- Audit who has which role at least quarterly. Look for users with overly broad permissions, inactive users who should be deactivated, and roles with permissions that are no longer needed.
6. Separate financial access carefully -- The FINANCIALS_VIEW_DETAILED and TEAM_EMPLOYEES_MODIFY_COMPENSATION permissions grant access to sensitive compensation data. Restrict these to finance, HR, and executive roles.

Related Pages

• SAML 2.0 Setup -- Configure SAML SSO and group-to-role mapping
• OAuth 2.0 Setup -- Configure OAuth SSO and group claims
• SCIM 2.0 Provisioning -- Automated user and group lifecycle management
• API Keys -- Grant permissions from this set to API keys
• Activity Log -- Review changes to workforce data