--- title: "👥 Understanding User Permissions" url: "https://help.scaut.com/en/article/-understanding-user-permissions" language: "en" last_updated: "2026-09-23T12:13:13.016Z" --- # 👥 Understanding User Permissions Learn about the different user permissions in Scaut and how to assign them to your team members. Access in Scaut is built from 50 individual permissions, grouped into clear areas. You give each member exactly the access they need, so a finance colleague can view orders without seeing screening results, and a hiring lead can see everyone's results without having access tobilling. ![](https://cdn-assets.productfruits.com/a4ef10df-1b03-4938-a35f-52e7f825c82b) ## How permissions work Each permission combines an area of Scaut with an action. For example, **Order · Create** lets someone place a screening order, and **Invoice · Read** lets them view your invoices. Most actions mean what they say: Create, Read (view), Update and Delete. A few are specific to their area: - **Execute:** submit an order for processing. - **Review:** mark a check as complete or disputed, with an optional written explanation. - **Purchase:** buy credit bundles or credits. - **Join and Cancel:** subscribe the organisation to a plan, or cancel it. - **Purge:** permanently erase subjects. - **Accept:** accept data shared by another organisation. - **Sandbox:** switch between sandbox and production mode. ## Read and ReadAll: the key difference Assessments, checks, orders and subjects each have two viewing permissions: - **Read** lets a member view records. If your organisation has role-based visibility switched on, they see only the records they created. - **ReadAll** lets a member view every record in the organisation, whoever created it. Assessments also have **ReadMember**, a narrower view that shows only results visible at member level. If someone cannot see a colleague's work, check whether they have ReadAll. ## The permission areas **Screening work** - **Assessment:** screening results. Create, Delete, Read, ReadAll, ReadMember, and Update, which includes approving an outcome. - **Check:** the individual checks within a screening. Read, ReadAll and Review. - **Order:** screening orders. Create, Delete, Execute, Read, ReadAll and Update. - **Subject:** the people you screen. Create, Delete, Purge, Read, ReadAll and Update. - **File:** your organisation's files. Create (upload), Read and Update. - **Product:** view the products available to your organisation. - **SubjectType:** view subject types. **Billing** - **Bundle:** view and purchase credit bundles. - **Credit:** purchase credits against an invoice. - **Invoice:** view your invoices. - **Plan:** view plans, join a plan or cancel it. - **Transaction:** view your credit transactions. **Organisation and team** - **Org:** view and update organisation details and settings, and switch between sandbox and production modes. - **Membership:** invite members, view them, change their permissions and remove them. - **Key:** create, view, update and delete API keys. **Sharing** - **Shared:** share subjects or questionnaires with another organisation, view, update and delete shares, and accept critical-infrastructure data shared with you. ## Common permission sets These combinations cover most teams. Use them as a starting point and adjust to fit. - **Full access:** all 50 permissions, covering screening, billing, team, organisation settings and sharing. Suits owners and administrators. - **Everyone's screening work:** views all orders, results, checks and subjects in the organisation, reviews checks, updates results, places, submits and updates orders, creates subjects and manages files. No billing or team settings. - **Own screening work, in depth:** views and updates results, reviews checks, places, submits and updates orders, creates subjects, manages files and views products. With role-based visibility on, sees only the records they created. - **Detailed view without changes:** views results and checks, places and submits orders, and views files, products and subjects. - **Everyday ordering:** places and submits orders, and views orders, subjects, files and results at member level. - **Billing only:** buys credit bundles and credits, joins or cancels plans, and views plans, invoices, transactions and orders. No access to subjects or results. - **Sharing:** views data shared with your organisation, or, for a wider set, creates, accepts, updates and deletes shares. - **Developer:** switches between sandbox and production mode. ## Setting a member's permissions 1. Go to \[Settings → Members\] and open the member, or invite a new one. 2. Tick the permissions they need. Use the search box to find a permission quickly, tick an area's heading to select everything in that area, or use **Select all** for full access. 3. Your selection appears below the list. Remove a permission with its ×, or use **Clear all** to start again. 4. Optionally, set an **expiry date**. This is useful for a contractor or auditor who needs access for a limited time. 5. Save your changes. Only members with Membership permissions can change what others can do. ## API keys and permissions An API key carries only the permissions it is given when it is created, and never more than the person creating it holds. Permissions that belong to a signed-in person, such as managing your team roster or making purchases, cannot be assigned to a key. ## Setting a member's permissions 1. Go to \[Settings → Members\] and open the member, or invite a new one. 2. Tick the permissions they need. Use the search box to find a permission quickly, tick an area's heading to select everything in that area, or use **Select all** for full access. 3. Your selection appears below the list. Remove a permission with its ×, or use **Clear all** to start again. 4. Optionally, set an **expiry date**. This is useful for a contractor or auditor who needs access for a limited time. 5. Save your changes. Only members with Membership permissions can change what others can do. Before this release, that meant Owners and Managers ## Frequently asked questions **Why can a member not see a colleague's orders or results?** They probably have Read but not ReadAll. With role-based visibility switched on, Read shows only the records a member created. Add ReadAll in the relevant area to show everything. **Can I give someone temporary access?** Yes. Set an expiry date when you choose their permissions, and their access ends on that date. **Can I remove my own admin access by mistake?** No. Owners and managers cannot remove their own admin role. **Why can a member not see Insights, or see only part of it?** Insights follows the same permissions as the rest of the platform. Check the member's Read and ReadAll permissions in the areas concerned. **Who can change permissions?** Any member with Membership permissions, which include viewing members, inviting them, changing their permissions and removing them. **Does an API key get the same permissions as the person who created it?** Not automatically. A key carries only the permissions it is given, and never more than its creator holds.sation. - **Shared manager:** manages sharing with other organisations (creating, accepting, updating and deleting shares) and updates organisation settings. - **Developer:** switches between sandbox and production mode. Every previous role except Developer also included managing API keys, so those members still can.