Roles & Permissions
What Owners, Admins, Members, and Viewers can do in a Better Analyst team, from team settings and security to chats, dashboards, tasks, Data Flows, alerts, and data sources.
Every team member has one role: Owner, Admin, Member, or Viewer. A few permissions also depend on who created an item, who pays for the team, or whether someone is an access manager for a data source.
Roles
Owner
The person who created the team, or the person ownership was transferred to. There is exactly one Owner. The Owner can do everything an Admin can, and is the only person who can change roles, manage Admins, transfer ownership, delete the team, and change domains, single sign-on, and sign-in requirements.
Admin
Admins run the team day to day. They can invite and remove Members, approve join requests, rename the team, delete team content, manage Slack, and manage data access on team data sources. Admins can't manage other Admins or the Owner, change roles, or change single sign-on settings.
Member
Members use the team workspace: they can open and continue team chats, upload files, build dashboards, and create tasks, Data Flows, and alerts. They can't manage people, team settings, or data access rules.
Viewer
Viewers open the team's dashboards and nothing else. On a dashboard built from a data source with per-member rules, they see only their own rows. They can't chat, ask the AI, build or change dashboards, upload files, or create tasks, Data Flows, or alerts, and team chats are hidden from them. Viewers are free and unlimited. Viewers are included with the Team and Enterprise plans.
In the team workspace, a viewer's sidebar shows only Dashboards, and the plan section says Viewer. Their personal workspace keeps their own plan (Free unless they pay for one); the team's plan doesn't carry over the way it does for Members. In team settings they see General and Members, where they can find their own attributes and leave the team.
The tables below cover Owners, Admins, and Members. Viewers can't do any of these actions except view a team dashboard and leave the team.
Other people a permission can depend on
- Creator. Some items can only be edited by the person who created them, plus Owners and Admins. Each table below says when.
- Billing contact. The person whose payment method pays for the team. They change the plan and payment details, whatever their role. Transferring ownership doesn't change who the billing contact is.
- Access manager. A Member an Owner or Admin names to manage one team data source's access rules, without making them an Admin. See access managers. Team plan.
Team settings
| Action | Owner | Admin | Member |
|---|---|---|---|
| See the member list | ✓ | ✓ | ✓ |
| Rename the team | ✓ | ✓ | ✗ |
| Invite Members | ✓ | ✓ | ✗ |
| Invite Admins | ✓ | ✗ | ✗ |
| Invite Viewers (Team) | ✓ | ✓ | ✗ |
| Cancel pending invites | ✓ | ✓ (Member and Viewer invites) | ✗ |
| Approve or decline join requests | ✓ | ✓ | ✗ |
| Remove Members and Viewers | ✓ | ✓ | ✗ |
| Remove Admins | ✓ | ✗ | ✗ |
| Change roles (Admin, Member, Viewer) | ✓ | ✗ | ✗ |
| Transfer ownership | ✓ | ✗ | ✗ |
| Leave the team | ✗ | ✓ | ✓ |
| Delete the team | ✓ | ✗ | ✗ |
The Owner can't leave the team; they transfer ownership first or delete the team. While the team has an active subscription, its billing contact can't leave or be removed.
On the Team plan, approving a join request is free while the team has 5 people or fewer. Past 5, each new person adds $15/month, and a team can't go past 50 people. On a grandfathered per-seat plan, it adds a billed seat, the same as an accepted invite.
Billing
| Action | Owner | Admin | Member |
|---|---|---|---|
| See the Billing tab | ✓ | ✓ | ✗ (unless they're the billing contact) |
| Change the plan | Billing contact only | Billing contact only | Billing contact only |
| Update payment details and invoices | Billing contact only | Billing contact only | Billing contact only |
| Subscribe or reactivate the team | ✓ | ✗ | ✗ |
See Team billing.
Security and the audit log
Security settings need the Enterprise plan. The audit log can be viewed for the last 30 days on Team; the full history and export need Enterprise. The Security and Audit log tabs are shown to Owners and Admins.
| Action | Owner | Admin | Member |
|---|---|---|---|
| See security settings | ✓ | ✓ | ✗ |
| Add or remove a verified domain | ✓ | ✗ | ✗ |
| Re-check a domain's verification | ✓ | ✓ | ✗ |
| Set up, turn on, or remove single sign-on | ✓ | ✗ | ✗ |
| Require single sign-on or two-factor sign-in | ✓ | ✗ | ✗ |
| Create SCIM tokens | ✓ | ✓ | ✗ |
| Revoke SCIM tokens | ✓ | ✓ | ✗ |
| View and export the audit log | ✓ | ✓ | ✗ |
Changing domains, single sign-on, sign-in requirements, or SCIM tokens also needs a strong sign-in: two-factor or single sign-on. See SSO & SCIM.
Slack
| Action | Owner | Admin | Member |
|---|---|---|---|
| Install or uninstall Slack for the team | ✓ | ✓ | ✗ |
| Choose which data sources Slack can use | ✓ | ✓ | ✗ |
| Link your own Slack account | ✓ | ✓ | ✓ |
| Unlink someone else's Slack account | ✓ | ✓ | ✗ |
| Ask questions in Slack | ✓ | ✓ | ✓ |
| Pick a channel for task or alert delivery | ✓ | ✓ | ✓ |
Slack isn't available to teams that require single sign-on or two-factor sign-in. See Slack privacy and permissions.
Chats, files, and reports
| Action | Owner | Admin | Member |
|---|---|---|---|
| Open and continue any team chat | ✓ | ✓ | ✓ |
| Rename a team chat | ✓ | ✓ | ✓ |
| Make a team chat public or private | ✓ | ✓ | Creator only |
| Delete your own team chats, files, and reports | ✓ | ✓ | ✓ |
| Delete other people's team chats, files, and reports | ✓ | ✓ | ✗ |
| Upload files to the team | ✓ | ✓ | ✓ |
| Rename team files | ✓ | ✓ | ✓ |
| Rename a report or make it public | ✓ | ✓ | ✓ |
| Replace a report's content | Creator | Creator | Creator |
| Share or stop sharing a chart | ✓ | ✓ | Whoever shared it, or the chat's creator |
| Open someone else's private chat | ✗ | ✗ | ✗ |
| Move one of your personal chats into the team | ✓ | ✓ | ✓ |
| Copy your personal tasks, files, data sources, Data Flows, brand kits, chart themes, and agents into the team | ✓ | ✓ | ✓ |
Team chats are collaborative: anyone on the team can continue or rename one. A chat that uses a data source with per-member rules is private to the person who ran it. Nobody else on the team can open it, including Owners and Admins, and it can't be made public.
Projects
| Action | Owner | Admin | Member |
|---|---|---|---|
| Create, edit, or archive a team project | ✓ | ✓ | ✗ |
| Move items you can see into a project | ✓ | ✓ | ✓ |
| Move items out of a private project | ✓ | ✓ | ✗ |
| Make a project private, or change its members (Team) | ✓ | ✓ | ✗ |
See Projects.
Private projects
On the Team plan, an Owner or Admin can make a team project private. Then only its chosen members, Owners, and Admins can see its chats, dashboards, Data Flows, alerts, and tasks, and only Owners and Admins can move items out of it or create public links. See Private projects.
Dashboards
| Action | Owner | Admin | Member |
|---|---|---|---|
| View team dashboards | ✓ | ✓ | ✓ |
| Create a dashboard | ✓ | ✓ | ✓ |
| Refresh a team dashboard's data | ✓ | ✓ | ✓ |
| Duplicate a team dashboard into your own copy | ✓ | ✓ | ✓ |
| Edit, rename, change sources, or restore a version (in the editor or through chat) | ✓ | ✓ | Creator only |
| Publish changes, make public, or get an embed code | ✓ | ✓ | Creator only |
| Schedule refreshes and deliveries | ✓ | ✓ | Creator only |
| Delete a team dashboard | ✓ | ✓ | Creator only |
| Set share branding on public links | ✓ | ✓ | Creator only |
Anyone on the team can view a team dashboard. Changing it is for whoever created it, or an Owner or Admin; others can duplicate it and change their copy. Dashboards that show each viewer their own rows can't be made public, embedded, or scheduled. See Dashboard sharing.
Scheduled tasks
| Action | Owner | Admin | Member |
|---|---|---|---|
| Create a task | ✓ | ✓ | ✓ |
| Run any team task now | ✓ | ✓ | ✓ |
| Edit a task's prompts, agent, schedule, and recipients | ✓ | ✓ | Creator only |
| Delete your own tasks | ✓ | ✓ | ✓ |
| Delete other people's tasks | ✓ | ✓ | ✗ |
Email and Slack recipients must be team members. Tasks can't use a data source with per-member rules. See Scheduling tasks.
Data Flows
| Action | Owner | Admin | Member |
|---|---|---|---|
| Create a Data Flow | ✓ | ✓ | ✓ |
| View or run any team Data Flow, or stop a run in progress | ✓ | ✓ | ✓ |
| Edit, pause, resume, or change a Data Flow's source or destination | ✓ | ✓ | Creator only |
| Delete a team Data Flow | ✓ | ✓ | Creator only |
Data Flows need an active team subscription and can't use a data source with per-member rules. See Data Flows.
Alerts
| Action | Owner | Admin | Member |
|---|---|---|---|
| Create a team alert | ✓ | ✓ | ✓ |
| View any team alert and its history, or send a test | ✓ | ✓ | ✓ |
| Edit, pause, or resume a team alert | ✓ | ✓ | Creator only |
| Delete a team alert | ✓ | ✓ | Creator only |
Alert emails go only to team members. Plan limits on alerts apply to the whole team. See Managing alerts.
Data sources
| Action | Owner | Admin | Creator | Other Members |
|---|---|---|---|---|
| Use team data sources in chats | ✓ | ✓ | ✓ | ✓ |
| Add a team data source | ✓ | ✓ | ✓ | ✓ |
| Rename a team data source | ✓ | ✓ | ✓ | ✗ |
| Reconnect or update sign-in details | ✗ | ✗ | ✓ | ✗ |
| Delete a team data source | ✓ | ✓ | ✓ | ✗ |
| Add knowledge base files | ✓ | ✓ | ✓ | ✗ |
| Remove a knowledge base file | ✓ | ✓ | If they uploaded it | If they uploaded it |
| Publish Data Context | ✓ | ✓ | ✓ | ✗ |
Only the person who connected a data source can update its sign-in details, whatever their role. To change them on a source a teammate connected, delete it and connect it again.
Data access
These apply to team data sources. Choosing tables and columns and fixed row rules work on every plan; per-member rules, Who can see this limits, access managers, and member attributes need the Team or Enterprise plan.
| Action | Owner | Admin | Access manager | Member |
|---|---|---|---|---|
| Choose the tables and columns a data source can read | ✓ | ✓ | ✓ | ✗ |
| Add and change row rules | ✓ | ✓ | ✓ | ✗ |
| Limit tables and columns with Who can see this | ✓ | ✓ | ✓ | ✗ |
| Use Preview as member | ✓ | ✓ | ✓ (without members' values) | ✗ |
| View a dashboard or ask a test question as a member | ✓ (when Who sees everything includes Owners) | ✓ (when it includes Admins) | ✗ | ✗ |
| Change Who sees everything | ✓ | ✓ | ✗ | ✗ |
| Choose access managers | ✓ | ✓ | ✗ | ✗ |
| Add member attribute fields | ✓ | ✓ | ✗ | ✗ |
| Set members' attribute values | ✓ | ✓ (not the Owner's) | ✗ | ✗ |
| See their own attribute values | ✓ | ✓ | ✓ | ✓ |
The person who connected a team data source can't change its access rules unless they're an Owner, Admin, or its access manager. Every change to access rules is recorded in the audit log. See Data Access and Member attributes.
Access managers
An access manager is a Member who looks after one team data source's access rules without being a team Admin. It isn't a role: an Owner or Admin names access managers on each data source's Data access page, under Who can manage access. Access managers open that page from the shield icon next to the source in Library → Connectors. They can't change Who sees everything, choose other access managers, or set member attributes. Access managers are included with the Team and Enterprise plans.
See Set up per-member data access.
Brand kits, agents, custom APIs, and embeds
| Action | Owner | Admin | Member |
|---|---|---|---|
| Create a brand kit or agent | ✓ | ✓ | ✓ |
| Edit a brand kit, or edit and publish an agent | ✓ | ✓ | Creator only |
| Delete a brand kit or agent | ✓ | ✓ | ✗ |
| Use custom APIs in chats | ✓ | ✓ | ✓ |
| Create, edit, or delete custom APIs | ✓ | ✓ | ✗ |
| Manage team embeds | ✓ | ✓ | ✗ |
Changing roles
Only the Owner can change roles:
- Promote a Member to Admin
- Demote an Admin to Member
- Make a Member or Admin a Viewer, or a Viewer a Member or Admin (Team). Viewers never count as people; past the 5 people included, this changes your extra-person charge. On a grandfathered per-seat plan, this changes your seat count
See Managing Members for step-by-step instructions.
Transferring ownership
The Owner can transfer ownership to any other Admin or Member. Viewers can't become the Owner; make them a Member first. This is permanent: the previous Owner becomes an Admin. Billing stays with the current billing contact. See Managing Members.