Custom roles in clariBI: a permission-by-permission guide
clariBI has five built-in roles made of 35 permissions. On Professional and Enterprise you can build your own roles from the same permissions. This guide explains each group, the setup steps and four example roles.
Every person in a clariBI organization has a role, and the role decides what they can see and change. There are five built-in roles, and for most small teams they are enough. When they are not, Professional and Enterprise plans let you build custom roles from the same 35 permissions. This guide goes through the permissions group by group, the steps to create a role, and a few roles worth copying.
The five built-in roles
| Role | Permissions | In short |
|---|---|---|
| Owner | 35 | Everything, including billing, security settings and the organization audit trail |
| Administrator | 29 | Users, data sources, reports, goals, settings and integrations; can view billing but not manage it |
| Analyst | 14 | Uploads and processes data, runs analyses, creates and edits reports and goals; cannot connect sources or manage users |
| Member | 8 | The default: views sources, analytics and goals, uploads files, creates and exports reports |
| Viewer | 6 | Read-only: views sources, analytics, reports and goals, and exports reports |
The built-in roles cannot be edited or deleted, so they stay a fixed baseline. The full matrix is in the roles and permissions reference, and the help article on the Owner, Administrator, Analyst, Member and Viewer roles explains how to assign them.
When a custom role is worth it
Custom roles help when a real job falls between two built-in roles. Typical cases:
- Someone who manages data connections but should not touch users or billing.
- A finance lead who should see billing and reports but not change data sources.
- A contractor who builds reports but should not delete anything.
- A person who owns goals and needs to see the data behind them, nothing else.
If the gap is "this person should see less", start by trying Viewer or Member. It is often closer than it looks.
Who can create roles, and on which plan
Custom roles are on Professional ($199 a month) and Enterprise ($999 a month). You also need the Manage User Roles permission, which Owners and Administrators have by default. On Free, Trial and Lite there is one user, so roles only start to matter from Starter (3 users), where the built-in roles apply.
The 35 permissions, group by group
The permissions come in 10 groups. The name in brackets is the code the app and API use.
User Management (5). View Users (users.view), Create Users (users.create), Edit Users (users.edit), Delete Users (users.delete) and Manage User Roles (users.manage_roles). Manage User Roles is what lets someone create and assign roles, so treat it like an admin permission.
Data Management (6). View, Create, Edit and Delete Data Sources (data.view_sources, data.create_sources, data.edit_sources, data.delete_sources), Upload Files (data.upload_files) and Process Data (data.process, which triggers processing and analysis).
Analytics and Insights (3). View Analytics (analytics.view), Create Analytics (analytics.create, running new analyses) and Advanced Analytics (analytics.advanced).
Reports and Dashboards (6). View, Create, Edit and Delete Reports (reports.view, reports.create, reports.edit, reports.delete), which cover dashboards as well as reports, plus Share Reports (reports.share, sharing outside the organization) and Export Reports (reports.export).
Goals and Tracking (4). View, Create, Edit and Delete Goals (goals.view, goals.create, goals.edit, goals.delete).
Billing and Subscriptions (2). View Billing (billing.view) and Manage Billing (billing.manage, changing plans and payment).
Organization Settings (3). View Settings (settings.view), Edit Settings (settings.edit) and Advanced Settings (settings.advanced).
Security and Access (3). View Security (security.view), Manage Security (security.manage) and Manage Audit Logs (security.audit_logs, which gives access to the organization audit trail).
Integrations (2). View Integrations (integration.view) and Manage Integrations (integration.manage).
System Administration (1). System Admin (admin.system). This one is reserved and cannot be granted in a custom role on any plan.
If you tick a permission for a feature your plan does not include, the builder refuses it when you save and names the permission.
Creating a role step by step
- Open Settings, then Organization, and go to Roles & Permissions.
- Click Create Role.
- Enter a name and, if you like, a description. Name the role after the job ("Data steward"), not the person ("Priya's role"), and use the description to say when it should be given out.
- Tick the permissions the role should have. Each shows its name and a short description.
- Click Create Role.
To give the role to someone, open the role's members in Roles & Permissions, pick the person from Select a member and add them. The same list removes people from the role.
Editing a role renames it or changes its permissions, and the change applies to everyone who holds it. A role can only be deleted when nobody has it, so move its members to another role first. Creating, changing and deleting roles are all recorded in the audit trail. The custom roles documentation has the same steps and a worked example.
Four roles worth copying
Data steward. Looks after connections and data quality. View, Create, Edit and Delete Data Sources; Upload Files; Process Data; View Analytics; Create Analytics; View Reports; Export Reports. Leave users, billing, settings and security unticked.
Report reader. Reads and exports, changes nothing. View Data Sources, View Analytics, View Reports, Export Reports, View Goals. This is close to Viewer; the difference is whatever you choose to leave out, for example removing Export Reports for people who should read in the app only.
Finance lead. Sees money and results, does not configure the product. View Billing, View Reports, Export Reports, View Analytics, View Goals, View Data Sources. Add Manage Billing only if this person really handles the subscription.
Goal owner. Runs the targets for a team. View, Create and Edit Goals; View Analytics; View Reports; View Data Sources. Leave Delete Goals with the Administrator so a goal's history is not removed by accident.
Mistakes to avoid
One role per person. If a 20-person team has 15 custom roles, nobody can tell who can do what. Build roles around jobs. Most small companies need the built-in roles plus two or three custom ones.
Delete without edit. Someone who can delete a report but not edit it can destroy work but not fix it. Pair each delete permission with the matching edit permission, or leave delete out.
Generous by default. Start with fewer permissions and add more when someone needs them. It is easier to grant access than to take it back after someone has seen the data. This matters most for contractors and temporary staff.
Forgetting the second layer. Organization roles are one layer. On Professional and Enterprise, workspaces have their own roles (viewer, contributor, editor and admin) for the content inside a workspace. Workspace roles decide what someone can do with the content inside a workspace, on top of their organization role; the help article on workspace roles explains how they combine.
Never reviewing. People change jobs. Put a reminder in the calendar every quarter to go through Roles & Permissions and check each role's members against who is actually doing that work.
Where roles are enforced
The app hides actions your role cannot take, and the server checks roles on its endpoints as well, so calling the API directly does not get around them. If you are setting up access for a whole team, the related post on setting up two-factor sign-in for your team is a good companion: two-factor sign-in with an authenticator app is available on every plan.
A first step
If you are on Professional, open Roles & Permissions, create a "Report reader" role with the five permissions above, and move one Viewer into it. Ask them to check that they can still open the dashboards they use. Once that works, build the next role your team actually needs.