# Permissions

## What decides what a person can do?

Two separate settings decide what a person can do. Their role decides whether they run the
workspace. Their permission on a dashboard, notebook, chat or skill decides whether they can open
it or change it.

| Setting | What it covers | Values |
|---|---|---|
| Role | Running the workspace | Admin, member |
| Permission | One dashboard, notebook, chat or skill | Owner, editor, viewer |

## How does Vistazo work out access?

Vistazo works out your access to an object in this order and stops at the first answer:

1. A workspace admin gets owner access to every dashboard, notebook and skill.
2. Anyone the object was shared with by name gets that grant.
3. A guest gets nothing further, since guests hold only what was shared with them by name.
4. Every other member gets the object's workspace row, from the Sharing pane.

A guest's answer is then lowered to **Viewer**, whatever the grant says. The grant itself stays on
record and applies in full if the guest becomes a member. Admins are never lowered.

Chats skip the first step. A conversation is private to its author and the people they share it
with, and workspace admins don't get into it.

Public access sits outside this order. While it is on, anyone with the address can read the object
in the public view, members and guests without a grant included
([How sharing works](/docs/sharing/overview#how-does-public-access-work)).

When an object's owner leaves the workspace, the people closest to it can claim it
([When an owner leaves](/docs/workspace/members#what-happens-when-an-owner-leaves)).

## Who can open a new object by default?

Each kind of object starts with its own workspace row. You change it per object in the Sharing pane.

| Object | A new one opens to the workspace as | Admins get in |
|---|---|---|
| Dashboard | **Viewer**, unless an admin changed the default | Yes |
| Notebook | Nobody, until its creator shares it | Yes |
| Skill | **Editor**, so every member can read and edit it | Yes |
| Chat | Nobody, until its author shares it | No |

An admin sets the default for new dashboards under **Settings → General → Details**, in the
**Sharing** card's **New dashboards** field. The choices are **Workspace can view**, **Workspace can
edit** and **Private**. Each dashboard's Sharing pane can still change its own row later.

A chat can only be shared as **Viewer**, because a conversation has one writer.

## Who can build?

Every member of a workspace can build. They can create dashboards, notebooks and skills, ask the
built-in assistant, and refresh what they read. Editing an object someone else made takes **Editor**
or **Owner** on that object.

Refreshing a dashboard you can only view updates your own view. A refresh everyone sees takes
**Editor** or **Owner**.

## What can a guest do?

A guest is someone outside your workspace who accepted an invitation to an object you shared by
email ([How sharing works](/docs/sharing/overview#how-do-you-invite-someone-from-outside)).

- A guest holds only what was shared with them by name. The workspace row never applies to them.
- A guest is always a viewer, whatever a grant says.
- A guest can't own an object, by transfer or by claiming one whose owner left.
- A guest opens what you shared inside their own workspace. Your workspace never appears in their
  list ([Shared with you](/docs/sharing/overview#where-do-things-shared-with-you-appear)).
- A guest sees no email addresses, no roles and no member list. In a shared dashboard's discussions
  they see the names of people in your workspace and can mention them.
- A guest gets no **Share** button, no **Sharing** or **Embed** settings and no button to request
  access.
- A guest can't filter, refresh, use the built-in assistant or run a notebook with their own
  parameter values. Those controls are hidden for them, and a link with filter values opens at the
  dashboard's defaults.
- A guest can't create dashboards, notebooks or chats in your workspace.

No admin setting gives a guest more. To let them edit, an admin makes them a member under
**Settings → Members → Make member**. Their existing grants then apply in full.

## What can an admin set for everyone?

No setting makes every member an editor of everything. Edit access is granted per dashboard,
notebook and skill, and a chat has only its author as a writer. An admin controls three things for the whole workspace, all under
**Settings → General → Details**:

| Setting | What it does |
|---|---|
| **New dashboards** | The workspace row a new dashboard starts with |
| **Public links** | Whether any object can have public access ([Public links switch](/docs/sharing/overview#how-does-an-admin-close-every-public-link)) |
| **Invite people outside the workspace** | Whether members can invite people by email from a Sharing pane |