The three roles
Global Admin
One per company. Immutable (can only be transferred). Has every permission, regardless of overrides.
Admin
All permissions ON by default. Global Admin can revoke individual permissions and lock the revocation.
Member
Curated default-ON set: upload demos, view team library, review own demos, send share links, leave comments.
Detailed comparison
Granular permission grid
Beyond the role defaults, Settings → Security & Permissions shows a checkbox grid of every individual permission for every teammate. Hover any row for an explanation of what that permission unlocks.Lock-by-Global-Admin mechanic
For each permission on each user, the Global Admin can:- Allow, user has the permission (role default OR explicit grant)
- Revoke, user does NOT have the permission, but they could be re-granted later
- Revoke + Lock, user does NOT have the permission, and only Global Admin can change it
Transferring Global Admin
If you want to hand off the role:1
Settings → Security & Permissions → Transfer Global Admin
Button only visible if you ARE the Global Admin.
2
Pick the new GA from the dropdown
Must be an existing teammate.
3
Confirm
Transfer is immediate. You become Admin; they become GA.
When to use which role
Auditing permission changes
Every permission edit is logged in the audit trail (visible to Global Admin). The log captures:- Who made the change
- What permission was changed
- Old → new value
- Timestamp
- Affected user
