Contents
- The comparison: a key ring
- The roles you start with
- Groups and sections
- How you notice your role
- Asking for access
- Good habits for owners
The comparison: a key ring
In an office, nobody gets the master key on day one. A new colleague gets the keys to the front door and their own office; the manager has a few more; only the caretaker has them all. In Exponential every permission comes from a role, which is such a key ring: a set of permissions (called policies), each opening one tool, possibly only in certain parts of the site or certain languages. A role does nothing until it is assigned to a person or a group (Roles for your team).
The roles you start with
A standard installation works with these roles (from the demonstration installation, as documented in Roles for your team):
| Role | Who has it | What it gives |
|---|---|---|
| Anonymous | every visitor who is not signed in | reading the public parts of the site |
| Member | registered visitors | signing in, their own account, members-only reading |
| Editor | the editorial team | signing in to the administration, creating and editing content, translations, versions, two-step sign-in, help |
| Administrator | very few people | everything |
Your site may have extra roles, for example for a layouts editor, a person who reads form submissions or shop staff.
Groups and sections
- User groups are like teams: Editors, Members, Administrator users. A role given to a group is given to everybody in it, now and later. That is why the administrator usually puts you in a group rather than giving you a role directly.
- Sections are parts of the site with their own rules, for example a members-only area or a department's pages. A role can be limited to one section: "may edit, but only in the Sports section" (How do I give a group edit rights on one section?).
How you notice your role
| What you see | What it means |
|---|---|
| Fewer tabs than a colleague | Your role does not include those tools |
| A grayed-out button | You may not use it here or now; point at it to read why (Editing content) |
| The requested page could not be displayed. (1) or Access denied | Your role may not open this page (When something goes wrong) |
| Your change becomes pending | Your role publishes through an approval |
None of these are errors, and none mean you did something wrong.
Asking for access
Tell your administrator what you want to do, not which permission you think you need: "I need to read the answers of the contact form" is easier to act on than "give me admin". The administrator then picks the smallest role that does the job. If you no longer need something, say so too: fewer keys means fewer risks.
Good habits for owners
- Give each person their own account. Shared accounts hide who did what.
- Keep the Administrator role for one or two people. Everyday editing does not need it.
- Review the list of people and roles a few times a year, and remove accounts of people who left (Handover checklist when someone leaves).
- Use the Team roles worksheet to write down who should have what.
Related pages
- Words explained
- Roles for your team
- Choosing roles for new staff
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner. Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster. Start with Partners: start here and How to apply.