Roles decide what each person in your workspace can do. Instead of turning restrictions on and off for each person, you give everyone a role, and you change the role when you want to change what they can do.
Only admins can manage roles.
The default roles
Every workspace starts with four roles:
Admin: full access, including members, roles and billing. Sees every identity and list. Can't be edited; duplicate it to make a custom admin role.
Member: works across the whole workspace. Can't manage members or roles.
Sales rep: runs campaigns from their assigned identities. Can't delete, import or export data.
Viewer: sees contacts and companies. Can't edit, import, export or run campaigns.
Roles were set up automatically from the access your teammates already had, so nobody's access changed and there is nothing for you to set up. If someone's access didn't match a default role, we created a role for that access. These roles are listed under Based on previous access. You can rename them, or move their members to a default role and delete them.
People who join later without an invitation also get a role: the one that matches the access they already have.
What a role controls
Permissions. There are 23, in four groups:
Contacts and companies: Edit contacts and companies, Delete contacts and companies, Import contacts, Import companies, Export to CSV and Excel, Send records to the CRM.
Campaigns and outreach: Create and edit campaigns, Launch and pause campaigns, Reply from the inbox, Post and engage on LinkedIn, Connect and share identities.
Automation and data: Create and edit workflows, Use SimilarWeb enrichment, View activity history, Run enrichments, Use AI Chat, Manage AI variables, playbook and message library.
Workspace: Manage workspace settings, Administer the workspace, Connect and configure integrations, View credit usage, Buy credits, seats, mailboxes and numbers, Manage teammates' work.
Three permissions need another one first. Delete needs Edit, Launch and pause campaigns needs Create and edit campaigns, and Post and engage on LinkedIn needs Edit.
Open What's included on any permission to see what it lets people do, and what happens without it.
Data access:
Identities: All identities, or Only assigned identities.
Lists: All lists, or Only lists shared with them.
Change what a role can do
Go to Settings → Roles and open a role.
Turn permissions on or off, and choose its data access.
Click Save changes. A summary shows what's added or removed and which members it applies to. It warns you if, for example, someone would have no identity to send from.
Confirm to apply the change to everyone with that role.
To create a role, click Create role and start from a copy of an existing one. Compare roles shows them side by side.
Give someone a role
One person: in Settings → Team, click the member, pick a role and click Change role. You see what they gain or lose first.
Several people: select them in the Team table and choose a role. Or open the role in Settings → Roles, go to its Members tab and click Add members. Each member has one role, so adding someone moves them from the role they have now.
New people: pick the role in the invite form, or use Copy from a member to give them the same role as a teammate. The invite link has its own role under Invite link role, and people who join with the link get that role. Changing it replaces the link, and the old link stops working. Roles that administer the workspace aren't offered for the link.
Default for new members: the Roles page marks the default role with Default for new members. To change it, open the role's menu (⋯) and choose Set as default for new members.
Good to know:
You can only give access you have yourself. If your own role lacks part of what a role includes, you can't assign that role. Ask an admin who has it.
A workspace always keeps at least one admin.
Identities
Identities are assigned to each person, separately from their role. When someone connects an identity, it's assigned to them. An admin can assign more in the member's panel on the Team page, or for several people at once.
The role decides whether the assignment matters. With All identities, the person sees every identity. With Only assigned identities, they see just the ones assigned to them.
"Custom access"
A member shows Custom access when their access was changed outside roles and matches none of them. They keep exactly that access. Pick a role for them to manage them with roles again.
When someone can't do something
The action is disabled, and a tooltip shows their role and the admins who can help. For example: "Your role (Sales rep) can't export to CSV or Excel. Ask an admin: Ana Ruiz and Joan Vidal."
A page they can't open shows You don't have access to this page, with the admins to ask.
API keys and MCP
API keys and MCP connections act as the person who created them. If that person's role doesn't include a permission, the matching API call or MCP tool is refused with a 403.