Roles and permissions¶
How access is decided¶
Every request passes four checks, in this order:
- Workspace. You only ever see your own organisation's data.
- Plan. Some modules need a plan feature (clause library, approval workflows, obligations, analytics, RevOps, audit trail, playbook, branding). If the plan doesn't include it, it is locked for everyone, admins included.
- Role permission. Your role must include the permission for the action. Admins hold every permission.
- Access to the contract. Being able to view contracts doesn't mean you can open every contract. You can open a contract if you own it, are an admin, handle its negotiation, approve one of its steps, or hold Contracts: view all. Anyone else is told the contract doesn't exist.
Opando hides what you can't do, and the server refuses it too.
Admin only¶
These can't be given to a role:
- Manage users, roles and departments
- Organisation settings, notifications, privacy, integrations, billing, header & footer
- Email templates
- Delete or change another person's contract
- Delete and restore uploaded signed contracts, and replace a signed copy
Default roles¶
✓ = granted. Admins have everything.
| Permission | Legal manager | Legal reviewer | Finance approver | Executive approver | Account executive | Viewer |
|---|---|---|---|---|---|---|
| Contracts: view | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Contracts: create | ✓ | ✓ | ||||
| Contracts: edit | ✓ | ✓ | ||||
| Contracts: export / download | ✓ | ✓ | ||||
| Contracts: send for signing | ✓ | ✓ | ||||
| Contracts: add signed contracts | ✓ | |||||
| Contracts: cancel | ✓ | |||||
| Contracts: re-open rejected | ✓ | |||||
| Respond in negotiation | ✓ | ✓ | ||||
| Approvals: view queue | ✓ | ✓ | ✓ | ✓ | ||
| Approvals: approve / return / reject | ✓ | ✓ | ✓ | ✓ | ||
| Workflows: view | ✓ | (picker only) | ||||
| Templates: view | ✓ | ✓ | ✓ | |||
| Templates: create & edit | ✓ | |||||
| Clause library: view | ✓ | ✓ | ✓ | |||
| Clause library: add / edit | ✓ | |||||
| Obligations: view | ✓ | ✓ | ✓ | |||
| Obligations: add | ✓ | ✓ | ||||
| Obligations: review AI suggestions, edit, mark done | ✓ | |||||
| Counterparties: view | ✓ | ✓ | ||||
| Counterparties: manage | ✓ | |||||
| Dashboard | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Negotiation analytics | ✓ | |||||
| RevOps | own + financial | all | ||||
| Negotiation playbook: view | ✓ |
Admins can change any role, or create new ones, in Roles & permissions.
Seats¶
- Paid seats are for people who create and work on contracts.
- Free Viewer/Approver seats are for people who only read and approve, up to a fair-use number based on your paid seats.
- Counterparties and external signers never need a seat.