Abilities

Access in Workforce Intelligence is controlled by abilities. A person can hold any combination. You assign them on Settings > Administration > Team, when you invite someone or when you change their role. Everyone also holds an implicit member ability, which needs no assignment.

The abilities you can assign#

The abilities you can choose in the Abilities list on the Team page are:

Choice	Ability	What it allows
Admin	admin	Instance administration only: company settings, Single sign-on, AI providers, company-wide API keys, updates, organization and Team secrets, people, abilities and Teams, bug-report triage, and the list of every SSH key registered in the company. It does not include any ability below.
Manage Coworkers	manage_coworkers	Hire a Coworker, be named as a Coworker's Supervisor, view the Coworker roster, edit a Work Center and author workflows. It does not make the person Supervisor of every Coworker; managing a Coworker belongs only to its own Supervisor, and only while that person holds this ability.
Manage Knowledge Bases	manage_knowledge_bases	Create Knowledge Bases, and manage the ones the person owns or can edit. It does not allow managing every Knowledge Base in the company, and admin does not either.
Manage Apps	manage_apps	Register Apps, and manage any App (not only ones the person built), including creating and revoking that App's API keys.
People manager	people_manager	View usage and cost for all Teams (as does executive). Everyone else sees usage for the teams they belong to.
Manage compensation	manage_compensation	See and edit the company's rate bands and assign them to Teams and people, on the Compensation tab in Governance.
Executive (view-only)	executive	A governance-view role. See every Coworker and App (including those in the Interview phase), their reviews, the WI Score, usage and cost across all Teams, the Compensation tab read-only, and the Value tab. May edit the WI Score's Output and Workforce cost and the Value rate card, and approve Coworkers that are waiting for approval under the Strict creation setting (never one they proposed themselves). Cannot change anything else or reach administration settings.
Auditor	auditor	A security and compliance role. Read and export the organization-wide Audit log on the Audit tab in Governance, look up the sources behind answers, and open Settings > Team read-only (members, abilities and Teams, with no way to change them). It does not allow exporting or erasing a person's data. Neither admin nor executive includes it.

An App's own Builder can manage that App without manage_apps. A Coworker's Supervisor manages that Coworker, but only while they hold Manage Coworkers: changing its model, Knowledge Bases, triggers, connectors and secrets, opening its terminal, reading its conversations, advancing and retiring it all belong to the named Supervisor who holds the ability, not to admin. If you revoke Manage Coworkers from someone, they lose all of this at once for every Coworker they are named on, and are treated like any other person who can reach it. Assign a new Supervisor to restore management.

Admins can approve proposed Coworkers just as executives can (an admin with neither Manage Coworkers nor Executive sees only the Proposed list on the Coworkers page, not the full roster), even though admin otherwise implies no other ability. See Coworker creation setting.

Admin is instance administration only#

Choosing Admin does not add or imply any other ability. Every ability is its own grant, and the Team page shows the hint "Admin covers instance administration only — settings, people and access. Choose the other abilities to give someone Coworker, App, Knowledge Base or executive access." An administrator who should also hire Coworkers, register Apps, create Knowledge Bases or see company-wide usage needs Manage Coworkers, Manage Apps, Manage Knowledge Bases or People manager chosen as well. A person who holds both Admin and another ability can use both.

Administrators can grant any ability to anyone, including abilities they do not hold themselves. Every grant or removal of an ability is recorded in the audit log, with who made the change and who it applied to. Granting or removing admin, manage_compensation, executive or auditor is also recorded in the deployment's logs.

What admin does not open:

• Coworkers. Changing a Coworker, opening its terminal, reading its conversations and managing its secrets belong to that Coworker's Supervisor. Workflow authoring needs Manage Coworkers.
• Knowledge Bases and Apps. Access comes from the abilities above, ownership or editor status, and Team membership. An administrator sees a Team-limited Knowledge Base, Coworker or App only as a member of that Team.
• Governance views. The WI Score, surveys, reviews across the company and usage across all Teams need Executive (view-only) or People manager as described in the table.
• The audit log. The Audit tab needs Auditor. An administrator who also holds Auditor can read it; Admin alone cannot, and neither can Executive (view-only).
• Secrets. Administrators manage organization and Team secrets. A Coworker's secrets belong to its Supervisor, and a person's own secrets belong to that person.

Approving a promotion request, for a Coworker or an App, is open to executives and administrators. An administrator can approve a request they filed; an executive who is not an administrator cannot. See Promotion gates.

Compensation access is separate from Admin#

An administrator who holds neither Manage compensation nor Executive (view-only) does not see the Compensation tab and cannot read or change rate bands. Grant Manage compensation to the people who maintain rates, and Executive (view-only) to people who need to read them.

Executive (view-only) does not reach the administration screens: Team and invitations, Single sign-on, AI providers, API keys, secrets and infrastructure still require admin. See Compensation for what the tab shows.

Abilities that are not on the Team page#

• Editing the WI Score's financial inputs and launching a survey campaign (the company's output and workforce cost) are limited to people with Executive (view-only). No other ability grants them.
• WI Score access is open to people with Executive (view-only).

Team scope is separate#

Abilities decide what a person may do. Teams decide which full-time Coworkers, Apps and Knowledge Bases a group of people can reach. An administrator is treated like any other person for Team scope and reaches a Team-limited resource only as a member of one of its Teams.

When changes apply#

Abilities are read from the person's record on every request, so a change you save on the Team page applies to their existing session without a new sign-in. Revoking someone is different: it ends their sessions immediately (see Managing people).

The last administrator#

The company always keeps at least one administrator. Removing Admin from, revoking or deleting the only person with Admin assigned on the Team page is refused with the message "You can't … the only administrator. Make someone else an administrator first." This includes clearing Admin on your own account. An administrator that exists only because of a single sign-on role mapping does not count: assign Admin to at least one person on the Team page.

Existing administrators#

Administrators who were in place when your deployment adopted this model were granted Manage Coworkers, Manage Knowledge Bases, Manage Apps and People manager, and so were the first administrator of a new company. Apps you deploy receive the signed-in person's abilities, and they should not treat admin as implying business abilities.

Unassigned Coworkers, Apps and Knowledge Bases#

When a person is revoked, the Coworkers they supervised, the Apps they built and the Knowledge Bases they owned become unassigned (see Managing people). People with the admin or executive ability see them in an Unassigned section at the top of the Coworkers, Apps and Knowledge Bases pages. Nobody else sees that section.

Select Assign on a card and choose a person. The list offers only people who can hold that role: Manage Coworkers for a Coworker's Supervisor, Manage Apps for an App's Builder and Manage Knowledge Bases for a Knowledge Base's owner. Assigning only sets the owner. It does not give you any management access to the item, and a Coworker's triggers stay paused until it has a Supervisor.