Roles and permissions in 5 minutes

Wevion has 7 roles from viewer to super_admin. Reference table — what each can do, when to pick which.

Written By Salvatore Sinigaglia

Last updated About 2 hours ago

Wevion has 7 roles from viewer to super_admin. Reference table — what each can do, when to pick which.

Roles and permissions in 5 minutes

Wevion has 7 roles with numeric power levels, but backend permissions are enforced through explicit role groups and route guards. Do not assume pure inheritance from the hierarchy. Roles are assigned per workspace — the same user can be Owner of Workspace A and Viewer of Workspace B.

Who is this for

Admins picking roles when inviting teammates, and anyone trying to understand what they can or cannot do.

The 7 roles at a glance

RolePower levelOne-line description
super_admin100Organization-wide control across all workspaces. Reserved for platform admins.
admin90Full control of a single workspace including settings and integrations.
owner80Workspace owner — full control plus owns billing within their workspace.
manager70Supervises campaigns and reads team data across members; cannot invite members, change roles, or access billing.
mediabuyer60Launches and edits campaigns. No team or billing access.
finance50Read-only on performance/financial views where enabled; cannot manage subscription/payment methods unless billing guards change.
viewer40Read-only across the whole workspace.

Detailed permission matrix

The table below is a practical guide, not an exhaustive spec. Under the hood, access is enforced by role groups rather than a strict cell-by-cell mapping, so a few edge actions may behave slightly differently — if a specific permission is business-critical for you, confirm it in the app for your role.

Actionviewerfinancemediabuyermanageradmin/owner
See dashboards and analytics✅✅✅✅✅
Export reports✅✅✅✅✅
Launch campaigns——✅✅✅
Edit campaigns / ad sets / ads——✅✅✅
Pause / resume / archive campaigns——✅✅✅
Bulk actions——✅✅✅
Use Creative Hub (upload + AI generate)✅ read—✅✅✅
Create / edit Rules——✅✅✅
Connect new ad platforms——✅—✅
Manage team (invite / change roles)————✅
Edit workspace settings (timezone, currency, ...)————✅
View invoices and billing—✅——✅
Change subscription plan————✅ admin/owner
Delete the workspace————✅ (owner only)

super_admin can do everything across the entire Organization.

How to pick a role

  • Default for a new teammate: mediabuyer if they actively run ads, viewer if they just need visibility.
  • Promoting someone: bump them one tier at a time as trust grows. There's no "approver" workflow inside Wevion — once admin changes a role, it applies immediately.
  • Multiple workspaces: assign different roles in each. Common pattern for agencies: a senior is admin in production workspaces and viewer in client-self-serve workspaces.
  • Finance: use for accounting/reporting visibility where enabled. The finance role intentionally has zero performance edit power and is not a billing administrator in current backend route guards.

Changing a role

  1. Open Settings → Team → People
  2. Find the row, click the action menu (three dots)
  3. Pick Change role → select the new role from the dropdown
  4. Confirm

The change takes effect on their next page navigation. If they're currently viewing something they no longer have access to, they see a "Permission changed — refresh" toast.

Audit log

Every role change, invite, and member removal is recorded in Settings → Team → Audit Log (/settings/team/audit-log). Available to admins and owners. Retention duration depends on your plan — see /settings/team/billing for the current value.

Special: super_admin

super_admin is rare and is set at Organization level, not workspace level. Typical setup: 1-2 super_admins per Org, usually the founder + CTO or platform lead. Super admins have visibility across all workspaces in the Organization and can act inside any of them.

To grant or revoke super_admin you must already be a super_admin. The first super_admin is set automatically on the user who creates the Organization (the first signup).

Common questions

  • Can the same user be admin in two workspaces but pay for only one seat? Yes. Seats are per-user, not per-membership.
  • Can I make a custom role? Not yet. You're limited to the 7 built-in roles. Custom RBAC is on the roadmap.
  • Does finance see ad performance? Yes, read-only where enabled. They cannot edit campaigns or manage subscription/payment methods in the current backend guards.
  • Can a viewer use Wavo? Yes, but Wavo cannot perform actions for viewers (it can only suggest). Action permissions follow your role.

FAQ

How many roles does Wevion have?

Wevion has 7 roles, each with a numeric power level: super_admin (100), admin (90), owner (80), manager (70), mediabuyer (60), finance (50), and viewer (40). Backend permissions are enforced through explicit role groups and route guards, so don't assume pure inheritance from the hierarchy — check the permission matrix for exactly what each role can do.

Are Wevion roles assigned per workspace?

Yes. Roles in Wevion are assigned per workspace, so the same user can be Owner of Workspace A and Viewer of Workspace B. This is a common agency pattern: a senior teammate is admin in production workspaces and viewer in client-self-serve workspaces. Seats stay per-user, so multiple memberships don't cost extra seats.

Who can view billing and change the subscription plan in Wevion?

Admins and owners can view invoices and billing and change the subscription plan for their workspace. The finance role can view invoices and billing (read-only) but cannot manage the subscription or payment methods in the current backend guards. Only the owner can delete the workspace itself.

How do I change someone's role in Wevion?

Open Settings → Team → People, find the person's row, click the action menu (three dots), pick Change role, select the new role, and confirm. The change takes effect on their next page navigation. If they're viewing something they no longer have access to, Wevion shows a "Permission changed — refresh" toast.

Who becomes the first super_admin in Wevion?

The first super_admin is set automatically on the user who creates the Organization — the first signup. super_admin is set at Organization level, not workspace level, and to grant or revoke it you must already be a super_admin. Super admins see all workspaces in the switcher and can act inside any of them.