Roles and permissions · Joripo documentation

Every person in an organisation has one role. The role is the most they may do anywhere in the organisation; which workspaces they reach, and whether they may see respondents' identities, are decided separately.

The four roles

Role	In the console	On a phone
Owner	Everything in the organisation, including its people, its settings, privacy and garbling.	Yes
Manager	Workspaces, forms and server datasets, device keys and approving phones, quality-check settings and quotas, case lists, the review workflow, purging data, exports.	Yes
Reviewer	Reads data, reviews quality findings, approves, rejects and corrects submissions, exports. Cannot deploy, delete or collect.	No
Data collector	No console: a page that explains how to collect, and the server's announcements.	Yes

The console shows each person exactly the controls the server accepts from them, and every route checks the role again on the server, so a hidden button is never the only thing stopping a request.

Owners

An organisation can have several owners, with the same powers, and always has at least one: an owner may step down once another active owner exists, and nobody (not even the server's maintainer) can demote or deactivate the last one. Only owners manage people, change the organisation's access settings, give identity access, change a garbling scheme and delete workspaces.

Which workspaces a person reaches

Owners reach every workspace, always.
Data collectors collect in the workspaces they are assigned to. By default that is Every workspace, including ones added later; an owner can tick particular ones instead (People › Edit › Workspaces). Their phones get keys, and their web forms open, only there. Taking a workspace away stops that phone's key at once; giving it back makes the same key work again.
Managers and reviewers see every workspace, unless an owner turns on Restricted workspaces (Configure › Server settings › Access). Then they reach only the workspaces they are assigned to, and everything else of the organisation is not found, as another organisation's would be: pages, the workspace switcher, the Data Explorer, exports, attachment links and the API. Turning the setting off gives everyone their organisation-wide role back; assignments are kept.

With restricted workspaces on, a manager can be narrowed in one workspace to Reviewer only (reads, changes nothing) or Data collector only (collects, sees no data). A narrowing never adds anything: a person may do in a workspace only what both their role and the narrowing allow.

Permissions beside the role

Some things are not decided by role at all:

Identity access (per workspace): who sees the answers marked as identifying (names, phone numbers, GPS) as they are. Owners always have it; an owner gives it to particular managers and reviewers on the workspace's Privacy page. See Identity access and privacy.
Key custodian (per garbling scheme): who may open a garbling scheme's sealed vault. See Answer garbling.
External access (per workspace): a person outside the organisation, such as a funder or a partner, given access to one workspace only, with a role of its own. See Sharing a workspace with external clients.

The server's maintainer is not a role

Running the server itself (creating organisations, setting plans, server health, backups) is the job of the server's maintainer, who signs in to Server administration with credentials kept outside every organisation. No owner can become a maintainer from the console, and every Server administration address is not found for everyone else. See Server administration.

Roles are fixed

The four roles cannot be edited and no new ones can be defined. They cover the boundaries that matter for a survey team, with workspace assignment, narrowing and identity access for the finer cases.