For Companies & Schools

Roles and Permissions

By Dakota Gordon

Last Updated October 22nd, 2026

Edlink uses a Role-Based Access Control (RBAC) architecture to manage access across the Edlink Dashboard and Meta API. Team members are assigned one or more Team Roles, where each role is a named collection of granular System Permissions.

System permissions follow a strict {entity}.{verb} convention across 52 distinct system entities and four standard CRUD verbs (read, create, update, delete), totaling 208 individual permissions.

Multi-Role Assignment: A team member can hold multiple roles simultaneously. A member's effective permissions represent the union of all permissions granted across all of their assigned roles.

Edlink Managed Roles (Default Roles)

Every Edlink team includes three built-in default roles that are created and maintained automatically by Edlink:

Role	Access Level	Description
Owner	Full Administrative Access	Complete, unrestricted access to all team resources and system actions, including team settings, custom role management, role assignments, member removal, and billing.
Editor	Read & Write Access	Broad operational read and write access across all standard team resources (applications, sources, integrations, onboarding, etc.). Cannot delete resources, create new teams, manage roles/permissions, or configure firewall blocks.
Viewer	Read-Only Access	Read-only visibility across all team resources, settings, and logs. Cannot create, modify, or delete any resources.

Managed Role Specifications

Owner: Granted all 208 permissions in the system catalog (Object.values(SystemPermission)).
Editor: Granted all *.read permissions, plus all *.create and *.update permissions, with the explicit exclusion of:
- All *.delete permissions.
- teams.create (creating new teams).
- team_roles.* and team_role_permissions.* (creating or modifying custom roles).
- blocks.* (managing network firewall IP and CIDR blocks).
Viewer: Granted all 52 *.read permissions.

Immutability of Managed Roles

Edlink managed roles are defined at the platform level and shared across all teams. To ensure consistent baseline security, managed roles cannot be edited or deleted. Any attempt to modify their permissions or delete them via the API or Dashboard will be rejected (403 Forbidden).

Team Creation and Member Invitations

Team Creator: The user who creates a new team is automatically assigned the Owner role.
Inviting Members: When inviting someone, owners (or members with memberships.create) pick one or more team roles up front. Those roles are attached to the inactive membership at create time and apply when the invitee accepts — there is no separate View and Edit / View Only remapping step.
Once a member joins the team, administrators can assign additional custom or managed roles at any time.

Managing Roles

To view or manage roles, navigate to Settings in the top navigation header and select Roles from the sidebar.

The User Roles page displays two sections:

Managed By Edlink: Lists the built-in catalog roles (Owner, Editor, Viewer). Clicking any managed role opens a read-only view of its assigned permissions and the number of active team members holding that role.
Custom Roles: Lists all custom roles created specifically for your team.

Creating a Custom Role

Members with the team_roles.create permission can create tailor-made roles suited for specific responsibilities:

Click Create a New Role on the Settings > Roles page.
Enter a descriptive Role Name (e.g., Integration Engineer or Support Specialist).
Enter an optional Description summarizing the role's purpose.
Select the desired permissions across the purpose-grouped permission matrices (Team, Applications, Sources, Integrations, Identity, Onboarding, Chats, Public Data, Billing, and Privacy).
Click Create Role to save. The new role is immediately available for assignment.

Editing or Deleting a Custom Role

Editing: Members with team_roles.update can click any custom role to adjust its name, description, or assigned permissions. Changes take effect immediately for all members holding that role.
Deleting: Members with team_roles.delete can click Delete Role in the role editor. Deleting a custom role immediately revokes that role and its associated permissions from all members who held it.

Assigning Roles to Team Members

Role assignments are managed on a per-member basis through the Team Members page:

Navigate to Settings > Members.
Click on any member's name in the table to open the Team Member sheet.
In the Assigned Roles section:
- Assign a Role: Use the role selector to search for and assign any managed or custom role. Requires the team_role_assignments.create permission.
- Revoke a Role: Click Revoke next to an assigned role to remove it from the member. Requires the team_role_assignments.delete permission.

Safety Rule: To prevent accidental lockouts, the last remaining Owner on a team cannot be removed or have their Owner role revoked without transferring ownership to another active team member first.

Permission Structure

All system permissions follow the {entity}.{verb} format, where each entity corresponds to a distinct Meta resource:

Verb	Action & Scope
read	View, list, or inspect existing records, configurations, and system logs.
create	Create, insert, or initialize new records or sub-resources.
update	Modify, patch, or execute trigger actions (e.g., validate, test, resend) on existing records.
delete	Permanently remove, revoke, or soft-destroy existing records.

Child resources have their own dedicated entities (e.g., credentials, publishable_keys, syncs, rules) rather than inheriting parent area permissions, providing granular access control.

Complete Permissions Catalog

The following tables document all 208 system permissions across the 52 system entities, grouped into the purpose categories displayed in the Dashboard role editor.

1. Team Administration (`team`)

Governs team organization settings, user memberships (including pending invites as inactive memberships), role assignments, role definitions, firewall blocks, and system audit logs.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Teams	Team profile and organization settings	`teams.read`	`teams.create`	`teams.update`	`teams.delete`
Memberships	Team member accounts and state (active members and pending invites)	`memberships.read`	`memberships.create`	`memberships.update`	`memberships.delete`
Team Roles	Custom role definitions	`team_roles.read`	`team_roles.create`	`team_roles.update`	`team_roles.delete`
Team Role Assignments	Member role assignments	`team_role_assignments.read`	`team_role_assignments.create`	`team_role_assignments.update`	`team_role_assignments.delete`
Team Role Permissions	Permission grants attached to roles	`team_role_permissions.read`	`team_role_permissions.create`	`team_role_permissions.update`	`team_role_permissions.delete`
Blocks	Firewall IP and CIDR access blocks	`blocks.read`	`blocks.create`	`blocks.update`	`blocks.delete`
Logs	System execution and audit logs	`logs.read`	`logs.create`	`logs.update`	`logs.delete`

2. Applications & Developer Keys (`applications`)

Governs applications, API credentials, publishable client-side keys, OAuth clients, webhook feed subscribers, origin security policies, and audit log schemas.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Applications	Application records and configurations	`applications.read`	`applications.create`	`applications.update`	`applications.delete`
Credentials	API secret keys and service credentials	`credentials.read`	`credentials.create`	`credentials.update`	`credentials.delete`
Publishable Keys	Frontend and client-side publishable API keys	`publishable_keys.read`	`publishable_keys.create`	`publishable_keys.update`	`publishable_keys.delete`
Clients	OAuth2 client applications	`clients.read`	`clients.create`	`clients.update`	`clients.delete`
Feed Subscribers	Real-time webhook and event subscribers	`feed_subscribers.read`	`feed_subscribers.create`	`feed_subscribers.update`	`feed_subscribers.delete`
Origin Policies	CORS and domain origin security policies	`origin_policies.read`	`origin_policies.create`	`origin_policies.update`	`origin_policies.delete`
Origin Policy CIDRs	CIDR IP network restrictions for origin policies	`origin_policy_cidrs.read`	`origin_policy_cidrs.create`	`origin_policy_cidrs.update`	`origin_policy_cidrs.delete`
Origin Policy Geos	Geographic country restrictions for origin policies	`origin_policy_geos.read`	`origin_policy_geos.create`	`origin_policy_geos.update`	`origin_policy_geos.delete`
Audit Log Schemas	Custom audit log validation rules and schemas	`audit_log_schemas.read`	`audit_log_schemas.create`	`audit_log_schemas.update`	`audit_log_schemas.delete`

3. Sources & Data Extractions (`sources`)

Governs data source connections (LMS, SIS), synchronization runs, extraction configurations, extractors, data enrichments, person linking, transformations, and overrides.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Sources	Upstream data sources (Canvas, ClassLink, etc.)	`sources.read`	`sources.create`	`sources.update`	`sources.delete`
Syncs	Synchronization pipeline runs	`syncs.read`	`syncs.create`	`syncs.update`	`syncs.delete`
Extractions	Raw data extraction job runs	`extractions.read`	`extractions.create`	`extractions.update`	`extractions.delete`
Extractors	Extraction connector definitions	`extractors.read`	`extractors.create`	`extractors.update`	`extractors.delete`
Enrichments	Source data enrichment processes	`enrichments.read`	`enrichments.create`	`enrichments.update`	`enrichments.delete`
Links	Cross-source person matching and linking	`links.read`	`links.create`	`links.update`	`links.delete`
Transformations	Source-level data transformation scripts	`transformations.read`	`transformations.create`	`transformations.update`	`transformations.delete`
Overrides	Source-level manual entity overrides	`overrides.read`	`overrides.create`	`overrides.update`	`overrides.delete`

4. Integrations & Synchronization Rules (`integrations`)

Governs application integrations with sources, materialized views, sharing rules, rule filter conditions, sync flows, rule previews, and batch sync jobs.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Integrations	Application-to-source integration connections	`integrations.read`	`integrations.create`	`integrations.update`	`integrations.delete`
Materializations	Cached integration database materializations	`materializations.read`	`materializations.create`	`materializations.update`	`materializations.delete`
Rules	Data sharing and filtering rules	`rules.read`	`rules.create`	`rules.update`	`rules.delete`
Conditions	Individual sharing rule filter conditions	`conditions.read`	`conditions.create`	`conditions.update`	`conditions.delete`
Flows	Data synchronization flow pipelines	`flows.read`	`flows.create`	`flows.update`	`flows.delete`
Previews	Sharing rule impact preview runs	`previews.read`	`previews.create`	`previews.update`	`previews.delete`
Jobs	Async integration background jobs	`jobs.read`	`jobs.create`	`jobs.update`	`jobs.delete`

5. Identity & Access (`identity`)

Governs single sign-on Identity Providers (SAML, OIDC), user logins, service account access tokens, and audit log session management.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Identity Providers	SAML and OIDC SSO identity providers	`idps.read`	`idps.create`	`idps.update`	`idps.delete`
Logins	User login session records	`logins.read`	`logins.create`	`logins.update`	`logins.delete`
Tokens	Service account and API access tokens	`tokens.read`	`tokens.create`	`tokens.update`	`tokens.delete`
Audit Log Sessions	User audit log and event sessions	`audit_log_sessions.read`	`audit_log_sessions.create`	`audit_log_sessions.update`	`audit_log_sessions.delete`

6. Onboarding (`onboarding`)

Governs client onboarding workflows and product catalog configurations.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Onboardings	Customer onboarding workflows and link requests	`onboardings.read`	`onboardings.create`	`onboardings.update`	`onboardings.delete`
Products	Application products available during onboarding	`products.read`	`products.create`	`products.update`	`products.delete`

7. Chats & Support (`chats`)

Governs integrated customer support and direct communication channels.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Chats	Customer support conversations and messages	`chats.read`	`chats.create`	`chats.update`	`chats.delete`

8. Monitoring (`monitoring`)

Governs dashboard-native monitor rules (live graph preview and future rule CRUD). Distinct from audit_log_sessions.*, which mint SIEM widget browse sessions.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Monitor Rules	Dashboard monitor rules and live graph preview	`monitor_rules.read`	`monitor_rules.create`	`monitor_rules.update`	`monitor_rules.delete`

9. Public Data & Directory Claims (`public_data`)

Governs educational institution directories, company directories, and domain verification claims.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Institutions	Educational institution directory profiles	`institutions.read`	`institutions.create`	`institutions.update`	`institutions.delete`
Companies	Vendor company profiles	`companies.read`	`companies.create`	`companies.update`	`companies.delete`
Institution Claims	Ownership and verification claims on institutions	`institution_claims.read`	`institution_claims.create`	`institution_claims.update`	`institution_claims.delete`
Company Claims	Ownership and verification claims on companies	`company_claims.read`	`company_claims.create`	`company_claims.update`	`company_claims.delete`

10. Billing & Subscriptions (`billing`)

Governs team subscription plans, recurring invoices, and payment methods.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Invoices	Billing invoices and payment receipts	`invoices.read`	`invoices.create`	`invoices.update`	`invoices.delete`
Subscriptions	Active subscription tiers and renewal cycles	`subscriptions.read`	`subscriptions.create`	`subscriptions.update`	`subscriptions.delete`
Plans	Available subscription pricing tiers	`plans.read`	`plans.create`	`plans.update`	`plans.delete`
Payment Methods	Credit cards and bank payment methods	`payment_methods.read`	`payment_methods.create`	`payment_methods.update`	`payment_methods.delete`

11. Privacy & Compliance (`privacy`)

Governs student data privacy agreements, custom agreement templates, privacy policies, third parties, and insurance coverage.

Entity	Description	Read Permission	Create Permission	Update Permission	Delete Permission
Agreements	Signed data privacy agreements (DPA)	`agreements.read`	`agreements.create`	`agreements.update`	`agreements.delete`
Agreement Templates	Standardized DPA contract templates	`agreement_templates.read`	`agreement_templates.create`	`agreement_templates.update`	`agreement_templates.delete`
Policies	Data retention and privacy policies	`policies.read`	`policies.create`	`policies.update`	`policies.delete`
Parties	Contracting parties and signatories	`parties.read`	`parties.create`	`parties.update`	`parties.delete`
Insurance Policies	Cyber liability and cybersecurity insurance policies	`insurance_policies.read`	`insurance_policies.create`	`insurance_policies.update`	`insurance_policies.delete`

Best Practices

Follow Least Privilege: Grant members only the permissions necessary for their daily responsibilities. For example, a customer support agent might require chats.* and sources.read, but not write access to billing or applications.
Restrict Administrative Verbs: Limit team_roles.*, team_role_assignments.*, memberships.delete, and blocks.* to trusted senior administrators.
Leverage Custom Roles: Instead of elevating developers or partners to Owner, construct purpose-built custom roles (e.g., Integration Engineer, Compliance Officer) with exact permissions tailored to their job functions.
Audit Role Assignments Regularly: Periodically review the Settings > Members list to verify that assigned roles align with current organizational responsibilities.
Prompt Offboarding: When team members transition or depart, revoke their role assignments or remove their membership immediately to safeguard your organization's integrations and student data.

Let's build something great together.

Talk to an Expert

Get Help With Your Integration

Create an Account