Users, roles and groups

Use Users, Roles and Groups under Access in workspace settings to decide what teammates can do and which data they can query. A role can allow an action, but querying a datasource also requires an authorized database credential.

Users and workspace membership

Users lists people who belong to this workspace. A pending invitation appears separately until the person joins. The Role shown for a user is the highest-ranked role they hold, not a summary of every permission or credential they have.

You need the relevant workspace permission to change memberships, roles, groups or credentials. Inviting someone, managing groups and managing credentials are separate permissions.

Roles and product actions

Roles control actions such as creating Explores, sharing work and managing workspace settings. Admin is the built-in role for new workspaces. It allows all workspace actions, including workspace deletion, and cannot be renamed, deleted or have its permissions changed.

New workspaces also start with an editable Member role, with baseline workspace access, Explore creation, listing and duplication, and data ingestion. Member permissions can be changed like those of a custom role; review them before assigning it. Access to an existing Explore also depends on how that Explore is shared.

Custom roles let you choose actions on the Features and Admin tabs. New custom roles include baseline access for opening and using the workspace; configure their feature and administration permissions before assigning people. Role and group names share one workspace-wide list: names must be unique regardless of capitalization and no longer than 128 characters.

A person can hold several roles and groups. Their permissions combine, but an explicit denial wins over an allowance from another role or group. The Users display ranks Admin first, followed by other roles alphabetically; that display order does not decide access.

Changing role memberships

Selecting a role on Users replaces that person's other role memberships and keeps their groups. The selector requires a role and does not remove all role memberships. A role's Members tab lists its users; manage assignments from Users. You cannot change your own role through the Users selector or remove the workspace's last Admin.

Developer access

The Developer switch on Users controls whether the Embedded sidebar entry is visible. It does not change roles, groups, datasource grants or the permissions required for Embedded and API operations.

Groups and datasource access

Use groups to give several people the same datasource credential. On a group's Datasources tab, select one credential per datasource, or No access. Changing the selection replaces that group's assignment for the datasource.

No access removes this group's contribution only. It does not cancel access from Everyone, another group, a role or an existing direct assignment. These paths can authorize credential use:

Deleting a custom role or group removes what it contributes, including its assignment on pending invitations. Other grant paths remain. Older datasource restrictions can still prevent access even when a group assigns a credential.

Credential selection

To query a datasource, a user needs datasource permission and exactly one distinct authorized credential for it. This applies to Admins too. Permission to manage a datasource or its credentials does not authorize a query.

Several paths to the same credential still count as one. Paths to different credentials create a conflict. Querio does not pick the highest role's credential or the one marked Default.

For example, if Everyone assigns credential A and the Finance group assigns credential B for the same datasource, Finance members cannot query until their effective access leaves exactly one usable credential. If both paths assign A, there is no credential conflict. An explicit denial can remove an otherwise allowed permission or credential use.

Sharing and invitation boundaries

The invitation form requires a role. Review the preselected role and choose Member or a custom role that permits the colleague's work. If no role is available, create one first. Sending through this form requires both permission to invite users and group management permission. The invitation preview lists datasources with credentials from Everyone and the selected role and groups. You can send an invitation with an empty preview.

A preview is not proof of datasource permission, conflict-free credential selection or a successful query. An invitation is not membership until accepted. For an existing Querio account, the standard invitation link opens sign-in, whose password and Google paths do not accept the invitation; an already signed-in account can also redirect without accepting it. Check that the person appears in Users before relying on their access. If they cannot join, contact Querio support.

Resending a pending invitation keeps its assignments. Inviting an existing workspace member does not change their memberships. To change a pending invitation's role or groups in Users, remove it and send a new one.

Sharing an Explore does not grant query access. If someone needs to rerun it, check their datasource permission and credential selection, then have them run a small query with their own account. For invitation steps, see Invite and configure your team. For connection and credential setup, see Datasources and credentials.