Skip to main content

Assign roles to groups

Assign organization roles and object roles to permission groups in Retool.

Assign organization roles and object roles to groups from the Settings > Groups page.

Organization roles​

  1. Navigate to Settings > Groups and select a group.
  2. Go to the Organization permissions tab.
  3. Click Add role.
  4. Select the organization roles to assign.
  5. Click Save.

To remove an organization role, click the Delete icon next to the role on the Organization permissions tab.

note

Default roles cannot be removed from their associated default groups.

Object roles​

Object roles are assigned from the Groups page, on the Object Permissions tab. The View by toggle (Object or Role) only changes how existing permissions are displayed.

Each object type in an object role has a grant type, either Universal or Individual. The grant type is set with the Apply universally toggle when the role is created.

  • Universal grants cover every object of that type in the organization, including objects created later.
  • Individual grants cover only the objects or folders you select. You choose them each time you assign the role, so the same role can be scoped to different objects for different groups.

To grant a group access to specific objects when the role's grant type is universal, create a separate role with Apply universally turned off. Refer to Grant types for more information.

From the Object view​

  1. Navigate to Settings > Groups and select a group.
  2. Go to the Object Permissions tab.
  3. Set View by to Object.
  4. Click Add object.
  5. Select an object role.
  6. For individual access, select the specific objects or folders to scope the role to.
  7. Click Save.

From the Role view​

  1. Navigate to Settings > Groups and select a group.
  2. Go to the Object Permissions tab.
  3. Set View by to Role.
  4. Click Add role.
  5. Select an object role.
  6. For individual access, select the specific objects or folders to scope the role to.
  7. Click Save.
note

When you scope a role to a folder, the permission applies to all objects within that folder, including objects added later. If an object is moved to a different folder, it inherits the permissions of its new parent folder.