Roles and permissions
Ply empowers teams and organizations to collaborate, while upholding security and access controls. With ultra granular controls and a smart management layer – you can set up Ply to work as you need it
There are 3 types of permissions in Ply:
Workspace permissions – control the general access a member has in the workspace, like whether a member can invite users, create features, or only use features.
Creator space permissions – only relevant to members who can create features, and controls which assets (such as features and connections) they can edit.
Feature usage permissions – controls who can use features.
In Ply, creation and usage permissions are two completely separate systems. Permission to create and edit features is controlled on the space level, and permissions to use features is controlled on the feature level.
Workspace permissions
Every member of your workspace has a workspace role, which defines their workspace permissions. The default role is end-user.
Workspace roles
Use features
✓
✓
✓
✓
✓
Access creator spaces (individual permission set at the space level)
✓
✓
✓
✓
See and use groups
✓
✓
✓
✓
Create spaces and be a space admin
✓
✓
✓
Invite users
✓
✓
Manage groups
✓
✓
Edit workspace settings
✓
Access all spaces in the workspace
✓
Manage billing
✓
Notes:
The owner of a workspace is always an admin. If you need to change an owner’s workspace role, re-assign ownership of the workspace first.
The owner cannot be removed by other admins
It’s recommended to have at least 2 admins in a workspace for redundancy.
Manager, Creator and Limited Creator are only available in Team Features Business or Enterprise plans
How to think about workspace roles
Here’s the gist of what every role was created for:
End-user – someone who uses features and doesn't build (probably most users in your organization)
Limited creator – a creator that is always supervised by someone else
Creator – a creator that can build and share anything, but only with existing users in your workspace.
Manager - a creator that can also invite members to your workspace, but only has edit access to assets they are assigned to.
Admin - an almighty member - has access to everything in the workspace, whether directly given to them or not.
Creator space permissions
Creator spaces act as a container for collaborative assets in Ply. Features, connections, and task logs are contained in creator spaces, and only creators with access to the space can see or use them, depending on their space role.
Creator space roles define the level of access a creator has to a space. These roles can only be assigned to members who have access to creator mode at the workspace-level, meaning they need have the role of Limited Creator or higher (end-users cannot be assigned these roles).
Creator space roles
See task log
✓
✓
✓
✓
View features in the space
✓
✓
✓
✓
Use all team features in the space
✓
✓
✓
Edit features
✓
✓
✓
Edit and use connections
✓
✓
✓
Test features
✓
✓
✓
Publish features
✓
✓
Manage use-access for features (share features with users)
✓
✓
Edit and use all connections marked as “sensitive”
✓
Manage access to space (invite collaborators)
✓
Edit space settings
✓
Notes:
Workspace admins have admin access to all spaces
When a space is created, the creating member is automatically the space admin. They can be removed by workspace admins.
Creators of one space can be users in another
It’s common for creators to have access to some spaces but not all of them. They can still use features from spaces where they don’t have creator access.
For example: a Sales Operations professional can have creator access to the “Sales” creator space, but not to the “HR” space. Creators in the “HR” space can still share features with the Sales Operations professional with use-only access.
Personal spaces and personal connections
Every member has a personal space where they can save assets. Personal spaces are only fully accessible to their owners, but workspace admins can see and delete content in them. These permissions cannot be edited.
When a member adds a connection to their personal space, it’s defined as a personal connection and can only be used by that member.
Learn more about personal spaces
Locked steps - using a creator’s personal connections in features
When a creator uses a personal connection for a step in a feature, and the connection mode is “one for all” (which is the default), the step become a “locked step” and can only be edited by the connection owner.
Learn more about connection modes
Advanced security and permissions
If you need even more control of how creators access and create assets in your workspace, an additional level of granularity is available with the following controls:
Space security settings – limit what types of features can be built in a space
Sensitive connections – connections only space admins can use
Group security settings – limit how a group can be used in your workspace
Read more in advanced security and permissions
Ways to limit connection usage within a creator space
By default, all connections in a creator space can be used by all creators. There are two ways to limit usage of a connection within a space:
Personal connection (locked step)
When creating a step and choosing a connection from your personal workspace, the step will be locked and only you can edit it. Other creators with edit access to the feature can replace your connection and gain the ability to edit the step.
Sensitive connection
When adding a connection to a space it can be marked as a sensitive connection.
Sensitive connections are only accessible to admins of the workspace, other users cannot edit steps used
Feature usage permissions (sharing)
Use access is granted on a per feature basis. Different features from the same creator space can be shared with different team members.
All team features except notifications (i.e. add-ons and tools)
Use-access for team features can be granted to members, groups and synced groups, and to all members of the workspace. Creators with contributor access (or higher) to a space have access to use all features in the space.
Notifications
Use-access to notifications is determined based on the member that the notification is sent to. To allow multiple users to respond to a notification, create a shared inbox. Members, groups and synced groups, and all members of the workspace can be invited to a shared inbox.
Customer feature sharing
Customer facing features are accessible to anyone with the link or access to pages where the feature is embedded.
Considerations when removing permissions
When a member’s role changes to a role with a higher level of access, no special consideration is required. However, when changing a role of a member to one with lower level of access, they lose access to some capabilities or assets and thus some considerations should be taken.
A space must have an admin
When downgrading a member’s role to limited creator or end-user (from a role with a higher permission level), it is required that the member is not the only admin of any creator space. If the member is the only admin of a space, you’ll need to assign another admin to the space before being able to change the role.
Last updated