Roles & Permissions

Control what each team member can see and do in the back office

The Roles & Permissions tab lets you define roles for your team and control exactly what each role can access. This keeps your workspace secure and ensures that each person only sees what they need to do their job.

Roles and permissions list

Default roles

Datakeen comes with three built-in roles:

RoleDescription
ControllerCan review and approve/reject documents and sessions
UserStandard user β€” can perform analyses but has limited admin access
Group AdministratorFull access to all features and settings

These default roles cover most team configurations. You can also create custom roles tailored to your specific needs.


Creating a custom role

Click "Create role" in the top-right corner to create a new role. You'll name it and then configure its permissions in detail.


Configuring permissions

Click the edit icon next to any role to open the "Set permissions" modal.

Configure permissions modal

Permissions are organised by resource type (Analysis, Journeys, Settings, etc.) and by action scope:

ScopeDescription
Group deleteDelete within the group
Personal deleteDelete own items only
Group writeWrite/edit within the group
Personal writeWrite/edit own items only
Group readView items within the group

Resource types

ResourceWhat it covers
AnalysisDocument analyses, AI results
DocumentsUploaded documents
FoldersCustomer folders
SessionsJourney sessions
JourneysJourney builder access
SettingsSettings and configuration

Simply toggle on the permissions each role should have, then click "Create role" (or update).


Assigning roles to users

Once roles are configured, go to the Users tab to invite team members and assign them a role. Each user can have one role, which determines exactly what they can see and do.


Tips

  • Follow the principle of least privilege β€” give each role only the permissions it strictly needs.
  • Analysts who only review documents don't need write access to Settings or the Journey Builder.
  • If you have contractors or temporary staff, create a restricted role with view-only access and deactivate it when their engagement ends.
  • The Group Administrator role has full access β€” assign it carefully.