Roles and permissions in 5 minutes

Last updated: May 19, 2026

Roles and permissions in 5 minutes

Wevion has 7 roles: super_admin > admin > owner > manager > mediabuyer > finance > viewer. Roles are assigned per workspace — the same user can be Owner of Workspace A and Viewer of Workspace B.

Who is this for

Admins picking roles when inviting teammates, and anyone trying to understand what they can or cannot do.

The 7 roles at a glance

Role

Power level

One-line description

super_admin

100

Organization-wide control across all workspaces. Reserved for platform admins.

admin

90

Full control of a single workspace including settings and integrations.

owner

80

Workspace owner — full control plus owns billing within their workspace.

manager

70

Manages day-to-day work and people, no billing access.

mediabuyer

60

Launches and edits campaigns. No team or billing access.

finance

50

Read-only on performance; full access to billing and invoices.

viewer

40

Read-only across the whole workspace.

Detailed permission matrix

Action

viewer

finance

mediabuyer

manager

admin/owner

See dashboards and analytics

✅

✅

✅

✅

✅

Export reports

✅

✅

✅

✅

✅

Launch campaigns

—

—

✅

✅

✅

Edit campaigns / ad sets / ads

—

—

✅

✅

✅

Pause / resume / archive campaigns

—

—

✅

✅

✅

Bulk actions

—

—

✅

✅

✅

Use Creative Hub (upload + AI generate)

✅ read

—

✅

✅

✅

Create / edit Rules

—

—

✅

✅

✅

Connect new ad platforms

—

—

—

✅

✅

Manage team (invite / change roles)

—

—

—

✅

✅

Edit workspace settings (timezone, currency, ...)

—

—

—

—

✅

View invoices and billing

—

✅

—

—

✅

Change subscription plan

—

✅

—

—

✅ (owner only)

Delete the workspace

—

—

—

—

✅ (owner only)

super_admin can do everything across the entire Organization.

How to pick a role

  • Default for a new teammate: mediabuyer if they actively run ads, viewer if they just need visibility.

  • Promoting someone: bump them one tier at a time as trust grows. There's no "approver" workflow inside Wevion — once admin changes a role, it applies immediately.

  • Multiple workspaces: assign different roles in each. Common pattern for agencies: a senior is admin in production workspaces and viewer in client-self-serve workspaces.

  • Finance: only assign to someone who actually pays bills. The finance role intentionally has zero performance edit power to prevent accidental damage.

Changing a role

  1. Open Settings → Team → People

  2. Find the row, click the action menu (three dots)

  3. Pick Change role → select the new role from the dropdown

  4. Confirm

The change takes effect on their next page navigation. If they're currently viewing something they no longer have access to, they see a "Permission changed — refresh" toast.

Audit log

Every role change, invite, and member removal is recorded in Settings → Team → Audit Log (/settings/team/audit-log). Available to admins and owners. Retention duration depends on your plan — see /settings/team/billing for the current value.

Special: super_admin

super_admin is rare and is set at Organization level, not workspace level. Typical setup: 1-2 super_admins per Org, usually the founder + CTO or platform lead. Super admins see all workspaces in the workspace switcher and can act inside any of them.

To grant or revoke super_admin you must already be a super_admin. The first super_admin is set automatically on the user who creates the Organization (the first signup).

Common questions

  • Can the same user be admin in two workspaces but pay for only one seat? Yes. Seats are per-user, not per-membership.

  • Can I make a custom role? Not yet. You're limited to the 7 built-in roles. Custom RBAC is on the roadmap.

  • Does finance see ad performance? Yes, read-only. They can export reports for accounting but cannot edit campaigns.

  • Can a viewer use Wavo? Yes, but Wavo cannot perform actions for viewers (it can only suggest). Action permissions follow your role.

Related