Roles and permissions

A role decides what someone can do in a workspace: generate, train reference sets, run workflows, invite people or change billing. Every member and service account holds one, so choosing it well is how you give people the access their job needs and nothing more.

How it works

A role is a named set of permissions. Each member holds one role in each workspace they belong to, and you choose it when you invite them or later from their row on the Members page. A change takes effect straight away, the next time they act.

On Enterprise, a member can also belong to groups, and each group can carry a role of its own. The member can then do everything their own role allows plus everything their groups' roles allow. Members whose role comes from a group show Group managed on the Members page.

To see exactly what a role grants, click your workspace name in the sidebar, choose Settings, and under People select Roles. Select a role's name to open its permissions. Roles that can hand over the workspace, its members, its billing or its sign-in carry an Admin access badge. The Roles page lists roles on the Enterprise plan; on other plans, the two built-in roles below are the whole list.

Built-in roles

Admin

Runs the workspace. An Admin has every permission: they manage members, roles and groups, billing and usage limits, sign-in (SSO and SCIM), workspace settings and AI controls, follow spend on the Usage page, publish through connected integrations and storefronts, and can delete the workspace. They can also do all the creative work a Creator does.

Creator

Does the creative work. A Creator generates, edits, trains reference sets, builds and runs workflows, writes agent skills, organizes the library and manages projects, and sees the workspace's Creative Unit balance as they work. A Creator cannot change who is in the workspace, what anyone may do, billing, sign-in or workspace settings, cannot open the Usage page, and cannot publish to a connected integration or storefront. New invitations start on Creator.

Custom roles

On the Enterprise plan you can build roles of your own from any set of permissions, such as an outsourcing partner who can generate but not train, or a reviewer who can see work without spending Creative Units. See Create a custom role.

A custom role made in a parent workspace can be given in every workspace below it.

Permissions

Every permission a role can grant, as it appears when you create or open a role, and which built-in roles hold it.

Workspace, members and billing

Labels, library and sessions

Projects, reference sets and generation

Workflows, skills and integrations

Settings pages

Everyone can open Settings from the workspace menu. The Account pages are each person's own, so every member sees them. Each workspace page is listed only for roles that hold the permission it needs.

Usage without Manage billing

The page shows the Creative Unit balance, storage and spend. It leaves out the subscription and one-time purchase cards, the storage upgrade link, the units breakdown and the export across child workspaces.

Delete workspace and Create label

On General, deleting the workspace needs Delete workspace. On Labels, Create label needs Create labels.

Members on Enterprise

Someone who can change member roles but not manage workspace settings sees inviting, suspending and removing members turned off, with Ask a workspace admin to invite, suspend or remove members.

What it means for you

• Start people on Creator. It covers every creative job. Make someone an Admin only when they need to run the workspace itself.

• Keep two Admins. The only Admin cannot change their own role, so promote a second person before anyone goes on leave or moves team.

• Let people see spend without buying. View usage opens the Usage page and nothing that changes the plan. Admin holds it; Creator sees the balance but not the breakdown. On Enterprise, give a producer or finance a custom role with View usage and View balance and without Manage billing.

• Publishing out of Layer is an Admin job by default. Pushing ads to a connected ad account or content to a storefront needs Publish to integrations or Publish to storefront. On Enterprise, a custom role can add them to a Creator's permissions for the people who ship.

• Spending is separate from seeing. Generate, Use realtime generation, Train reference sets and Run workflows spend Creative Units. To cap what a team spends rather than what it can do, set a usage limit. See Creative Units.

• Service accounts hold roles too. Give a pipeline the smallest role that covers what it does. See Set up a service account for the API.

Related

• Invite teammates and set their roles

• Create a custom role

• See what your workspace has spent

• Set a usage limit for a group

• Set up user provisioning with SCIM

• Parent and child workspaces