Roles and permissions

A role decides what someone can do in a workspace: generate, train reference sets, run workflows, invite people or change billing. Every member and service account holds one, so choosing it well is how you give people the access their job needs and nothing more.

How it works

A role is a named set of permissions. Each member holds one role in each workspace they belong to, and you choose it when you invite them or later from their row on the Members page. A change takes effect straight away, the next time they act.

On Enterprise, a member can also belong to groups, and each group can carry a role of its own. The member can then do everything their own role allows plus everything their groups' roles allow. Members whose role comes from a group show Group managed on the Members page.

To see exactly what a role grants, click your workspace name in the sidebar, choose Settings, and under People select Roles. Select a role's name to open its permissions. Roles that can hand over the workspace, its members, its billing or its sign-in carry an Admin access badge. The Roles page lists roles on the Enterprise plan; on other plans, the two built-in roles below are the whole list.

Built-in roles

Admin

Runs the workspace. An Admin has every permission: they manage members, roles and groups, billing and usage limits, sign-in (SSO and SCIM), workspace settings and AI controls, publish through connected integrations and storefronts, and can delete the workspace. They can also do all the creative work a Creator does.

Creator

Does the creative work. A Creator generates, edits, trains reference sets, builds and runs workflows, writes agent skills, organizes the library and manages projects, and can see the workspace's Creative Unit balance. A Creator cannot change who is in the workspace, what anyone may do, billing, sign-in or workspace settings, and cannot publish to a connected integration or storefront. New invitations start on Creator.

Custom roles

On the Enterprise plan you can build roles of your own from any set of permissions, such as an outsourcing partner who can generate but not train, or a reviewer who can see work without spending Creative Units. See Create a custom role.

A custom role made in a parent workspace can be given in every workspace below it. Artist, Art Director, Editor and Settings Admin are not built-in roles; Enterprise workspaces that use them hold them as custom roles of the same name, with the same permissions, and can edit them like any other custom role.

Permissions

Every permission a role can grant, as it appears when you create or open a role, and which built-in roles hold it.

Workspace, members and billing

Labels, library and sessions

Projects, styles and generation

Workflows, skills and integrations

What it means for you

• Start people on Creator. It covers every creative job. Make someone an Admin only when they need to run the workspace itself.

• Keep two Admins. The only Admin cannot change their own role, so promote a second person before anyone goes on leave or moves team.

• Publishing out of Layer is an Admin job by default. Pushing ads to a connected ad account or content to a storefront needs Publish to integrations or Publish to storefront. On Enterprise, a custom role can add them to a Creator's permissions for the people who ship.

• Spending is separate from seeing. Generate, Use realtime generation, Train reference sets and Run workflows spend Creative Units. To cap what a team spends rather than what it can do, set a usage limit. See Creative Units.

• Service accounts hold roles too. Give a pipeline the smallest role that covers what it does. See Set up a service account for the API.

Related

• Invite teammates and set their roles

• Create a custom role

• Set a usage limit for a group

• Set up user provisioning with SCIM

• Parent and child workspaces