Roles
Define what people can do in Querio, from creating analysis to managing the workspace.
Assign a role to each user. Use Admin for people who manage the workspace, or create a role with the permissions a particular team needs. Groups handle datasource credentials separately.
Default roles
| Role | Permissions |
|---|---|
| Admin | Full workspace control, including deletion. This built-in role cannot be renamed, deleted or edited. |
| Member | Included in new workspaces with basic access, Explore creation and duplication, and table uploads. It is editable, so its permissions may differ in your workspace. |
Assign another Admin before removing or changing the last one. The Users page does not let you change your own role.
Custom roles
Open Settings > Roles to create a role or edit an existing one.
| Tab | What it controls |
|---|---|
| Members | Shows people with this role. Use Manage in Users to change assignments. |
| Features | Actions such as creating and sharing Explores, editing context, uploading tables and using programmatic features. |
| Admin | Managing users and groups, datasources, integrations, SSO, billing and workspace settings. |
| Settings | Rename or delete a custom role. |
A new role includes basic workspace access. Choose its additional permissions on Features and Admin, then select Save changes before assigning it. See Control what people can do for the steps.
Role names must be unique across roles and groups, ignoring capitalization, and no longer than 128 characters.
Feature permissions
These are the toggles on Features. Turning one on allows the listed actions; access to a specific Explore or datasource is still checked separately.
Explores
| Toggle | What it allows | Reference |
|---|---|---|
| Create explores | Start new Explores and list accessible Explores. | Explores |
| Duplicate explores | Create copies of existing Explores. | Duplicate and continue |
| Change explore status | Set or clear the status of Explores the person can edit. | Statuses and tags |
| Share explores with people | View, add and remove sharing access for workspace users. | Sharing and access |
| Public share links | Create and manage links that expose saved content without sign-in. | Public sharing |
Context
| Toggle | What it allows | Reference |
|---|---|---|
| Edit catalog and knowledge base | Create, edit, rename and delete context files, including catalog descriptions, joins, golden queries and skills. | Context |
| Upload tables | Import files as queryable tables. Querying those tables still requires datasource access. | Managed files |
Programmatic
| Toggle | What it allows | Reference |
|---|---|---|
| Show embedded tab | Show the Embedded entry in the sidebar where Embedded is enabled. | Embedded API |
| API keys | Create and manage keys for scripts and other systems. | API authentication |
| iFrame embeds | Create and manage tokens for embedding Querio in another product. | Embedded authentication |
Show embedded tab controls visibility only. Enable API keys or iFrame embeds for the relevant token operations; datasource access is still required to run queries.
Admin permissions
These are the toggles on Admin. Give them to people who should manage the corresponding settings for the workspace.
| Toggle | What it allows | Reference |
|---|---|---|
| Name and logo | Rename the workspace and upload, replace or remove its logo. | General settings |
| Workspace settings | Change workspace defaults, including the default model and visibility for new Explores. | Workspace defaults |
| Statuses and tags | Add, rename and remove the labels used across the workspace. | Statuses and tags |
| Usage and billing | View usage, change the plan and update payment details. | Usage and billing |
| Members and invites | Manage workspace membership and invitations, including inviting and removing users. The invitation form also requires Groups. | Users |
| Groups | Create and manage groups and custom roles, including their user assignments and permissions. | Groups, Roles |
| Single sign-on | Configure Okta OIDC and the workspace sign-in mode. | Single sign-on |
| Slack | Connect and configure the workspace's Slack integration. | Workspace integrations, Ask from Slack |
| Datasource access and credentials | Create, replace and delete credentials and secrets, and manage datasource sharing. This does not itself authorize queries. | Datasources and credentials, Data access |
Changing permissions
Changes apply to everyone assigned to the role. A person with several assignments receives the permissions they allow; an explicit denial takes priority over an allowance.
Changing the role in Settings > Users replaces that person's other role assignments and keeps their groups. Before deleting a custom role, give its users another role so they retain workspace access. Deletion also removes the role from pending invitations.
Access to a particular Explore or board also depends on its sharing settings. Running queries requires datasource access, even for Admins.
Last updated on October 30, 2026