Skip to main content

Admin granularity

Use Admin granularity to delegate organizational settings to non-admin users without granting full administrator access.

Admin granularity is an Enterprise plan feature of role-based access control (RBAC) that gives organization admins fine-grained control over which organizational settings non-admin users can manage. Rather than choosing between granting full admin access or no access at all, you can create roles that delegate specific settings, such as SSO configuration or billing management, to the teams that need them.

How admin granularity works​

Retool's RBAC system includes organization permission scopes: settings that affect the whole organization rather than individual objects. Both Business and Enterprise plans support RBAC for organization permissions, but the available scopes differ:

  • Business plan: Roles can include scopes for non-admin settings such as query library access, draft app management, theme editing, and user visibility.
  • Enterprise plan: Admin granularity expands this to include the full set of organization permission scopes, covering sensitive administrative settings like SSO, billing, IAM credentials, and audit logs. This lets admins delegate specific administrative capabilities to non-admin users without granting full administrator access.

When a user's group is assigned a role, they can access only the settings pages or permissions access that the role grants, and nothing more.

Permissions are additive: if a user belongs to multiple groups with different roles, they inherit the combined set of permissions from all their groups.

When to use admin granularity​

Admin granularity is most useful when your organization has teams that own specific parts of your Retool configuration but shouldn't have unrestricted admin access. Common scenarios include:

  • IT or identity teams that manage SSO and user provisioning but don't need access to billing or app settings.
  • Platform or DevOps teams that configure environments, config variables, and IAM credentials without requiring full admin rights.
  • Finance teams that need to view and manage billing independently.
  • Design teams that manage branding and themes without touching infrastructure settings.

In each case, you can create a focused role with only the relevant permissions and assign it to the appropriate group. This follows the principle of least privilege, granting only what's needed for a user to do their job.

Manage admin granularity​

You can manage admin granularity through the following pages under Settings > Permissions:

  • Groups: Control access to apps, resources, workflows, and agents. Use groups to determine what your users can build and use in Retool. The Object Permissions tab on each group's detail page shows the combined view of object access from both group configuration and role assignments.
  • Roles & Permissions: Control access to organization settings. Use roles to determine which teams can configure Retool itself by delegating specific organization permission scopes.

These settings pages work together. A user can be in a group that controls what they can build and use in Retool, while also holding a role that grants access to specific organization settings pages.