Roles, permissions & company boundaries

Learner — your learning

Learners land on Learning space at /learn. They can discover permitted courses and collections, follow collections, use assigned pathways, resume their own learning, complete knowledge checks and download their own available certificates. Resources, learning inbox, received messages, calendar, saved courses, profile and preferences remain available.

Learners do not see People, Learning groups, team reports, authoring, company settings or Platform console. A single-view account does not show Workspace view. A company switcher is separate: it lists only companies the person can access.

Author — create and publish

Organisation-wide authors have Course studio at /studio, module and section editing/reordering, publication, resource authoring, collection and pathway builders, and Learning packages where configured. AI course drafting and resource assistance additionally depend on company feature policy, an activated provider and usage limits.

Author access alone does not grant team management, People, company settings or cross-company access. Published versions preserve existing learner assignments.

Team manager — scoped learning operations

The stored role is unit_manager; the UI calls its workspace Manage team. Managers land on Team overview at /manage/reports. They can use People, Teams and Learning groups within their permitted scope, assign courses and pathways, recommend collections, inspect progress, generate authorised reports and send messages to their permitted audience.

People selections are explicit batches of up to 100, not every matching search result. Managers do not create company-wide groups or grant roles through these controls. Team hierarchy and learning-group membership are different: joining a group grants neither management powers nor course access.

Company administrator — company operations

An organisation-wide administrator lands on Company overview at /admin and has management, authoring and personal-learning views. They can manage the company profile, manual learning groups, company-wide learning assignments/reports/messages and configured activity integrations. Company settings also exposes address and AI controls subject to installation policy and recent sign-in.

In People & access, administrators inspect role bindings; changing other members’ roles or suspending members is owner-only in this screen. Administrators inspect SSO connections; owners prepare and submit them. A broad permission bundle does not bypass an operation’s additional owner, scope or recent-authentication checks.

Company owner — access and federation

An organisation-wide owner has the company administrator experience plus management of other members’ role scopes and suspension, and preparation/submission of SAML or OIDC connection drafts. Owners cannot change their own access in this screen or remove the last active owner. Reactivation is a separate recovery-qualified procedure.

Submitting SSO configuration requests operator activation; it does not prove a successful federation test. Multiple SSO connections do not automatically provision users, link matching emails or grant roles.

Platform operator — cross-company controls

Platform console at /clients requires an active organisation-wide owner membership and an explicit server-side operator allowlist entry. Company administrator or owner status alone is insufficient. Operators open dedicated company pages to inspect counts and activity, edit profiles and classification, control address self-service and AI governance, and enter an audited read-only support view.

View as user is read-only, lasts at most 15 minutes, requires a support reason and recent authentication, and shows a return banner. It cannot submit learning, send messages or change settings as the target. Act as user is separate and disabled by default. When enabled, it allows reviewed native course, assignment, progress and resource commands with target permissions and dual-identity audit. Credentials, MFA, company settings and other write routes remain blocked. Other designated platform operators cannot be support-view targets.

Visitors, demo users and integration principals

Signed-out visitors can read the public site, sample course catalogue, documentation and legal pages. The explicit interactive demo uses fictional records and is not a real company membership or a source of valid certificates.

integration_principal remains a reserved role with no default permissions. Company settings → Integrations provides separate named service accounts, scoped partner tokens and signed learning webhooks. Owners/administrators manage them with recent authentication. Dedicated n8n/Zapier connector qualification remains pending; see Company API access & webhooks.

Multiple roles and permission boundaries

Workspace view appears only when more than one server-approved view is available. Default landing priority is company administration, team management, authoring, then personal learning. Switching views changes navigation, not permissions. Multi-role users retain their legitimate capabilities on shared pages.

Role grants are scoped to a company and sometimes a team subtree. Company administration and authoring require organisation-wide grants for the screens described here. The Go API checks active membership, role, operation, ownership and scope; PostgreSQL row-level security provides a further boundary. Hiding a menu is not authorisation. Role restrictions or suspension can invalidate sessions and support views.

Manage existing members

New-member invitations, self-service provisioning and arbitrary custom-role design are not available in this screen. Never infer company-wide authority from a team label, a learning group or a selected workspace view.

1. Open Company settings → People & access.
2. Inspect the member’s exact role and team scope.
3. As an owner, change only the required scope and confirm the outcome.
4. Ask the member to sign in again after an access restriction.