# Collaborator roles
Collaborator roles control team access to Workato features, functions, and folders of Role-based access control.
Here, we cover the following topics:
To find out about the privileges collaborators can have, see Collaborator privileges.
Have Environment Setup?
Find out how Environment works with Team roles.
# System Roles
Workato pre-defines system roles so you can easily assign them to team collaborators, based on the access each user requires.
Workato has four system roles: Team owner, Admin, Analyst, and Operator.
You cannot edit these roles directly. However, you can clone each role, and then modify it.
To view the privileges of a system role, a Team Admin can select a role in the Roles tab. This opens a read-only version of the role.
# Team owner
The Team Owner role is the most permissive system role. It owns the root login (username/password) for the account and includes full access to all settings for the account.
- All Admin role privileges
- All privileges included in the Admin role.
- Full Account Settings access
- Access to all account settings.
# Admin
Typically granted to users managing the Workato team account, Admins have nearly equivalent privileges to the Team Owner. Aside from the Team Owner, this is the most permissive system role.
- Full project access
- All project permissions: View, edit, create, and delete.
- Full folder access
- All folder permissions: View, edit, create, and delete.
- Full connection access
- All connection permissions: View, edit, create, and delete.
- Full recipe access
- All recipe permissions: View, edit, create, delete, run, and view job history.
- Full access network trace
- View network traces in job histories. Includes recipe input, output, and the network trace of HTTP calls. HTTP call information includes HTTP headers, requests, and communication (responses) between Workato and the end application.
- All projects
- Access to all projects in a workspace.
- Full access
- Full access
- Access to the API Platform, including dashboard and logs, collections and endpoints, clients and access profiles, policies, and settings.
- Full Common data model access
- All Common data model permissions: View, edit, create, and delete.
- Full Custom OAuth Profile access
- All Custom OAuth Profile permissions: View, edit, create, and delete.
- Full Lookup table access
- Access to the Lookup tables feature.
- Full Message template access
- All Message template permissions: View, edit, create, and delete.
- Full On-prem groups access
- Access all on-prem groups and agents in the workspace.
- Full People task access
- Access to the People task tool.
- Full Properties access
- Access to all Environment Properties in the workspace.
- Full Pub/Sub access
- All Pub/Sub permissions: View, edit, create, and delete topics.
- Full Recipe lifecycle management access
- Access to the Recipe lifecycle management feature.
- Full Workbot access
- All Workbot permissions: View, edit, create, and delete.
- Full Runtime user connection access
- All Runtime user connection permissions: View and edit.
- Full Logs access
- Access to the Workato Log Service feature.
- Full Connector SDK access
- All Connector SDK permissions: View, edit, create, and delete.
- Full Collaborator access
- Manage the team collaborators in the workspace, including adding, editing, and removing collaborators.
- Full Custom collaborator roles access
- View, edit, create, and delete custom team roles in the workspace.
- Full Collaborator SAML SSO access
- View and edit SAML SSO settings for the workspace.
- Full API client access
- View and edit API Clients for the workspace.
- Full activity audit
- Access to view team activity in the Dashboard's Activity audit log. This permission grants the user the ability to view all activity logs, regardless of other access settings.
- Full key management
- Access to the account's Key Management System (KMS). Users with this privilege can update key policies and encryption keys.
# Analyst
Analysts are typically users who build and test recipes or custom connectors.
- Full project access
- All project permissions: View, edit, create, and delete.
- Full folder access
- All folder permissions: View, edit, create, and delete.
- Full connection access
- All connection permissions: View, edit, create, and delete.
- Full recipe access
- All recipe permissions: View, edit, create, delete, run, and view job history.
- All projects
- Access to all projects in a workspace.
- Full access
- Access to the API Platform, including dashboard and logs, collections and endpoints, clients and access profiles, policies, and settings.
- Full Common data model access
- All Common data model permissions: View, edit, create, and delete.
- Full Custom OAuth Profile access
- All Custom OAuth Profile permissions: View, edit, create, and delete.
- Full Lookup table access
- Access to the Lookup tables feature.
- Full Message template access
- All Message template permissions: View, edit, create, and delete.
- Full On-prem groups access
- Access all on-prem groups and agents in the workspace.
- Full People task access
- Access to the People task tool.
- Full Pub/Sub access
- All Pub/Sub permissions: View, edit, create, and delete topics.
- Full Workbot access
- All Workbot permissions: View, edit, create, and delete.
- Full Runtime user connection access
- All Runtime user connection permissions: View and edit.
- Full Connector SDK access
- All Connector SDK permissions: View, edit, create, and delete.
# Operator
Operators are users who focus on maintaining and validating existing recipes. This is the least permissive system role.
This role includes read-only access to All folders and All projects.
- View projects
- View specific projects in a workspace.
- View folders
- View folders and sub-folders in a workspace.
- View recipes
- View recipes in a workspace.
- Test (start/stop) recipes
- Run recipes and start and stop recipe tests in a workspace.
- View recipe job history
- View a recipe's job history in the Jobs tab.
- All projects
- Access to all projects in a workspace.
# Custom Roles
CUSTOM ROLES IS AN ADD-ON
Custom roles is available as an add-on. Contact your Customer Success Manager for more information.
Workato also supports custom roles, enabling you to assign granular privileges to team collaborators.
For example: Development, QA, and Production teams are working in the same account. As part of the Recipe development lifecycle, you can create and assign roles with specific privileges to each team.
Refer to the Role-based access guide to learn how to create a custom role.