Operate
Access control
Roles, policies and per-collection permissions that apply the same way to Studio, REST, GraphQL and MCP.
By the end of this guide, you will know how to choose workspace roles, grant per-collection permissions and check what a user’s token can access. Studio, REST, GraphQL and MCP all use the same workspace authorization.
Before you start
- Have a workspace and the collections whose access you want to configure.
- Use the owner account to manage members and access.
- Decide which collections each member needs to read or change.
1. Choose a built-in role
| Role | Can do |
|---|---|
| Owner | Everything, including members and access |
| Administrator | Manage the data model and every record |
| Editor | Create, edit and delete records |
| Viewer | Read records |
| Public | Unauthenticated API access, off by default |
Note: Owner and administrator access cannot be reduced. There is one owner per installation, and ownership can be transferred.
2. Add custom roles and policies if needed
Create up to 20 custom roles and 50 policies per workspace in Settings → Roles and Settings → Policies. A policy grants create, read, update or delete per collection, so you can let a role read orders but edit only notes.
3. Review per-collection access
Editors and viewers can get different CRUD rights on individual collections. Studio shows each member’s effective access next to every collection in the data model.
4. Check token and agent permissions
Personal API tokens act as the user who created them, with the same permissions. They expire, are stored as hashes and can be revoked. Tokens cannot manage credentials or change passwords. MCP tools use the same rules, so an agent never sees more than its token’s owner.
Note: Personal tokens inherit their owner’s permissions. Scoped or read-only API keys and service accounts are planned; do not treat a personal token as a separately scoped credential.
Troubleshooting
- An editor or viewer cannot access a collection: review the member’s effective access in that workspace and any per-collection overrides in the data model.
- An override does not restrict an administrator: owner and administrator access cannot be reduced. Choose a role with the intended permissions instead.
- A token cannot change a password or manage credentials: personal API tokens do not allow these operations, even when their owner can perform them in Studio.
- Unauthenticated API access is unavailable: the Public role is off by default. Review whether public access is intended before changing access settings.