Roles and permissions

Owner, Admin, and Member

Permissions are authoritative

A role is a managed collection of permissions. The permission assigned to the active membership determines whether a protected read or action is allowed; the role label alone is not the final check.

Delegated administration

Owners can delegate supported administrative work by adjusting role permissions. Delegate only the areas a person needs, then verify both the visible workspace and the intended protected actions.

• Member, registration, announcement, event, email, settings, role, audit, notification, and chat-governance permissions are grouped by responsibility.
• Sensitive private member fields use additional permissions rather than broad member-read access.

Community-scoped access

Permissions apply within the active community membership. A valid permission in one community does not authorize access to another community, and suspended memberships cannot use normal authenticated access.

Participant-scoped chat

Chat visibility and send permissions control whether the workspace and actions are available. They do not turn chat into a global inbox: conversation reads, messages, keys, attachments, presence, and realtime rooms still require active participation in that conversation.

Role and status changes

A role change affects later authenticated permission checks. Suspension removes active membership access; reactivation restores the membership with its assigned role. Ownership safeguards prevent unsafe self-removal and changes that would leave the community without an active owner.