Every super admin holds one console role. A console role decides which sections of the Platform Console its holders can open, where they can make changes, and whether they can enter workspaces, and as which workspace role. Console roles are separate from workspace roles: a console permission never counts inside a workspace, and a workspace permission never counts in the console.
Where to find it
Super admins → Roles in the console (/admin/admins/roles). Roles holding Super admins & roles view see the list; only those with Act create, edit or delete roles. The list shows each role's name, a Locked badge on Owner, what it can do, the entry role if it enters workspaces, and how many super admins hold it.
Console modules
Each module has View (read only) and Act (create, edit, delete). Act includes View.
| Module | View | Act |
|---|---|---|
| Overview | Indicators across all workspaces, export | — |
| Workspaces | The workspace list and each workspace's page | Create (with its first Workspace Admin invitation), edit, suspend, reactivate, delete, restore |
| Users | Users across every workspace | Invite, change role, disable, enable, remove, password and two-factor resets |
| Taxonomy | The global taxonomy | Create, edit, archive and link sectors, sub-sectors, job families, competencies and position templates |
| Super admins & roles | Super admins and console roles | Invite super admins, change their role, step them out or back in, reset their two-factor; create, edit and delete console roles |
| Activity | The Activity log (View only) | — |
| Integrations | — (View grants nothing yet) | Open Integrations: create, edit, pause and delete deployment-level read integrations, issue and revoke their keys, manage their webhooks. See Console integrations |
Enter a workspace is a separate permission under Workspaces. Workspaces Act doesn't include it. The console's Security page (your own two-factor) needs no permission.
The seeded roles
- Owner (locked): everything, including entering any workspace as its Workspace Admin. It is the only console role that can enter a new workspace. It can't be edited or deleted. The platform always keeps at least one active Owner: you can't step out or move the last one.
- Viewer: Overview and Workspaces view. Built for executives who need consolidated indicators. It changes nothing and can't enter workspaces.
Entry role
A console role that holds Enter a workspace must name an Entry role: the workspace role its holders work with inside a workspace. You can pick one of the original workspace role presets except Workspace Admin (Workforce Architect, Talent Acquisition, Talent Development, Line Manager, Recruitment Junior, Viewer). Only Owner enters as Workspace Admin.
- Inside the workspace, the super admin can do exactly what that workspace's role allows there, including any edits the workspace made to it.
- The entry role works only in a workspace that still has that preset role, which means workspaces created before roles became admin-built. A new workspace starts with only Workspace Admin, so only the Owner can enter it. Entering is refused with "This workspace has no role role. Only the Owner can enter it." The same happens if an older workspace deleted that role.
- If you change a console role's entry role, or a super admin's console role, any visit they have open ends on their next click, and their next entry uses the new role.
- Each entry records the role they entered as, both in the console's Activity log and in the workspace's Audit log.
Creating a role
- Super admins → Roles → New role.
- Enter the Role name, an optional Arabic name and an optional Description.
- Switch View or Act on per module. To let the role enter workspaces, tick Enter a workspace and choose its Entry role.
- Save.
Two examples:
- Taxonomy editor: Taxonomy View and Act, nothing else. For the team that maintains the global library, with no access to workspaces or users.
- HQ Recruiter: Overview and Workspaces view, plus Enter a workspace with entry role Talent Acquisition. Headquarters recruiters can follow every workspace's indicators and work the hiring pipeline of older workspaces that still have a Talent Acquisition role, without seeing their settings, roles or people records. New workspaces are entered by an Owner only.
Guards
- You can only tick permissions you hold yourself, and only give the entry role your own role enters as.
- You can't edit the role you hold.
- Only an Owner can grant Super admins & roles Act, assign a role that holds it, or make someone an Owner.
- A role can be deleted only when no super admin holds it.
- A console role with Users Act, other than Owner, can't make anyone a Workspace Admin, can't give a workspace role that manages users and roles, and can't change, disable, remove or reset a Workspace Admin.
Every role change, and every change of a super admin's role, is recorded in the Activity log with what was added and removed.
Two-factor
Every super admin signs in with an authenticator app, whatever their console role. See Super admins and handover.