Roles & Permissions

Nembl uses role-based access control (RBAC) to govern what users and agents can do within your company. Every member is assigned one or more roles that determine their permissions across the platform.

System Roles

Nembl provides three built-in system roles that cannot be modified or deleted.

Every new user who accepts an invitation is assigned the Member role by default unless the inviting admin specifies a different role.

Custom Roles

When system roles are not granular enough, create custom roles to match your organization's structure.

Creating a Custom Role

1. Navigate to Settings > IAM > Roles.
2. Click Create Role.
3. Enter a role name and optional description (e.g., "Service Manager" or "Read-Only Auditor").
4. Select the permissions to include. Permissions are grouped by resource type:
   • Services -- create, read, update, delete, publish
   • Workflows -- create, read, update, delete, publish, execute
   • Requests -- create, read, update, assign, close
   • Organizations -- create, read, update, delete
   • Teams -- create, read, update, delete, manage members
   • Users -- invite, read, update, disable
   • Policies -- create, read, update, delete
   • Secrets -- create, read, update, delete
   • Billing -- view plans, manage subscription
5. Click Save.

Permission Format

Each permission follows the pattern resource:action. For example:

services:create
workflows:publish
requests:assign
teams:manage_members

You can use wildcards to grant all actions on a resource:

services:*       # All service permissions
workflows:*      # All workflow permissions

Assigning Roles to Users

Individual Assignment

1. Navigate to Settings > IAM > Members.
2. Click on the user you want to modify.
3. In the Roles section, click Add Role.
4. Select one or more roles from the dropdown.
5. Click Save.

Bulk Assignment via Groups

Rather than assigning roles to individual users, assign roles to groups. All members of the group inherit the group's roles. This is the recommended approach for organizations with more than a handful of users.

Role Precedence

When a user has multiple roles (either directly assigned or inherited through groups), permissions are combined additively. If any role grants a permission, the user has that permission. Explicit Deny policies always override role-based Allow permissions -- see Policies & ABAC for details.

Viewing Effective Permissions

To see the complete set of permissions a user has after combining all roles, group memberships, and policies:

1. Navigate to Settings > IAM > Members.
2. Click on the user.
3. Open the Effective Permissions tab.

This view resolves all role assignments, group inheritance, and policy overrides into a single list of allowed and denied actions.

Best Practices

• Use system roles for most users. The Owner/Admin/Member model is sufficient for many small teams.
• Create custom roles for specialized access. For example, a "Workflow Designer" role that can create and publish workflows but cannot manage users.
• Prefer group-based assignment. Assign roles to groups rather than individuals to simplify management as your team grows.
• Audit role assignments regularly. Review who has Admin and Owner roles quarterly to ensure least-privilege access.
• Use policies for exceptions. If a user needs most of a role's permissions but should be denied one specific action, use a Deny policy rather than creating a new role.