Updating a member's role and permissions

What a member can see and do in Veridox comes from their role, and from the permissions your organisation gives that role. So there are two ways to change someone's access, both in the Organisation group of Settings:

• Change the member's role on the Teams & members page. This changes one person.
• Change what a role can do on the Roles & permissions page. This changes everyone in that role.

This article covers both. For the background on roles, see Roles and permissions, Shared cases: let everyone see every case, and Teams & members.

What you need

Access to these pages depends on your own permissions, not just your role:

• To change a member's role, your role needs Update and promote members. By default that's Organisation Owners and Organisation Admins.
• To see the Roles & permissions page, your role needs View organisation settings, API keys and webhooks. By default that's Organisation Owners and Organisation Admins.
• To change what a role can do, your role also needs Edit settings, branding, API keys and webhooks. By default that's Organisation Owners only. If you can view the page but not edit it, every checkbox is disabled.

Roles are ranked: Organisation Owner, then Organisation Admin, then Analyst, then Member. You can only act on roles at or below your own rank, and you can never change your own role or your own role's permissions. An Organisation Owner can do everything, always.

Change a member's role

1. Go to Settings → Teams & members.
2. Keep the team filter on All Teams so the All Members table is showing. (When a single team is selected, the role column switches to the team role instead.)
3. Find the member. A pencil icon appears beside their Org Role; its hover label reads Change role.
4. Select the pencil, choose the new role from the Role list, and select Update role.

You'll see a confirmation that the member's role has been updated. A few rules apply:

• You can't change your own role. The pencil is disabled on your own row.
• You can only assign a role at or below your own rank, and you can only change members whose current role is at or below your own rank. An Organisation Admin can make someone an Organisation Admin, Analyst, or Member, but can't change an Organisation Owner.
• Organisation Owner isn't in the list. Contact Veridox to add or change an owner. The organisation's only owner can't be demoted.
• The change takes effect within a few minutes. The member's current sessions end, so they're signed out everywhere and need to sign in again.
• If you demote someone who has API keys, their keys keep the permissions they were created with. Review their keys on the API keys page and revoke any that are no longer appropriate (see API keys).

Change what a role can do

1. Go to Settings → Roles & permissions.
2. Choose a role from the Role list. A note tells you how many of the available permissions that role currently holds.
3. Permissions are grouped into cards by area: Cases, Files, Members, Teams, Settings, Single sign-on, and Billing. Tick or untick a permission to change it, or use Select all / Clear all on a card. A dot marks each permission you've changed but not yet saved.
4. Select Save in the bar at the bottom of the page. The bar shows how many unsaved changes you have. Select Discard to drop them instead.

A few things to know:

• Organisation Owner can't be changed. Owners always have full access, and every box in that role is locked on.
• Your own role, and any role above it, is locked too. Pick a role ranked below your own.
• Changes apply to each member of the role within a few minutes. Nobody is signed out.
• A change affects everyone in that role. To change access for one person, change their role instead (see above).
• API keys aren't affected. A key's access comes from the permissions set on the key itself, not from the roles on this page.
• If you switch roles in the list before saving, your unsaved changes stay staged, and the role shows a dot in the list so you don't lose track. Leaving the page with unsaved changes asks you to confirm.

What each permission allows

The table shows the permissions, grouped by area, and which roles hold each one by default. Your organisation may have changed these.

Some points worth knowing:

• Without View all organisation cases and View all organisation files, a member sees only the cases and files they created themselves. Grant both together: a case without its files opens empty. See Shared cases: let everyone see every case.
• Each permission is independent. Granting a role Upload files doesn't also grant it View all organisation files; the member still sees only their own uploads.
• Permanently delete files only has an effect if permanent deletion is enabled for your organisation. Archive files hides a file but keeps it.
• Override AI risk scores is needed to change a file's risk level to a different one. Anyone with access to a case can still confirm its current level.

Check what changed

Every role change and every permission change is recorded in your organisation's Audit log in Settings, as Member role changed and Role permissions updated, with who made the change and when. See The audit log.

If someone says they've lost access

A member who was signed out unexpectedly, or who sees a greyed-out Upload button with a permission note, has usually had their role or their role's permissions changed. See Signed out unexpectedly, or Upload greyed out? for what to tell them.