User Permissions
Grail uses role-based access control (RBAC) to manage what users can do within your organization. Every user is assigned a role that determines their permissions.
There are three organization roles, from most restricted to most powerful:
- Viewer — The default role. Browse and search the media library.
- Editor — Everything a Viewer can do, plus organize assets with tags and metadata, share assets and projects, and request processing jobs.
- Admin — Full control within the organization, including user management, agents, and storage sources.
Permissions by Role
Section titled “Permissions by Role”| Action | Viewer | Editor | Admin |
|---|---|---|---|
| Browse and search assets | ✓ | ✓ | ✓ |
| Stream and preview media | ✓ | ✓ | ✓ |
| View transcripts | ✓ | ✓ | ✓ |
| View tags, metadata, people, and faces within assets | ✓ | ✓ | ✓ |
| View asset processing status and visual-index results | ✓ | ✓ | ✓ |
| Add comments and reactions | ✓ | ✓ | ✓ |
| Update own profile | ✓ | ✓ | ✓ |
| Change own password | ✓ | ✓ | ✓ |
| Copy asset paths and export selected assets | ✓ | ✓ | ✓ |
| View projects | ✓ | ✓ | ✓ |
| Open the Tags, People, and Jobs pages | ✓ | ✓ | |
| Create, edit, and delete tags | ✓ | ✓ | |
| Create, edit, and organize projects | ✓ | ✓ | |
| Add and remove tags on assets | ✓ | ✓ | |
| Edit asset metadata, individually or in bulk | ✓ | ✓ | |
| Share assets publicly | ✓ | ✓ | |
| Share projects publicly | ✓ | ✓ | |
| Create, edit, revoke, and copy file request links | ✓ | ✓ | |
| Resolve uploads that need verification | ✓ | ✓ | |
| Enable file requests on a storage source | ✓ | ||
| View storage source context on assets | ✓ | ✓ | ✓ |
| Manage agents and storage sources | ✓ | ||
| Configure project roots | ✓ | ||
| Configure metadata fields | ✓ | ||
| Manage organization settings and single sign-on | ✓ | ||
| Enable or disable visual indexing for the organization | ✓ | ||
| Request indexing, hashing, transcription, proxy, and thumbnail jobs | ✓ | ✓ | |
| Request visual indexing and curate people and faces | ✓ | ✓ | |
| Cancel jobs and change job priority | ✓ | ✓ | |
| Request archive restores, refresh file metadata, and deduplicate assets | ✓ | ✓ | |
| Create new users | ✓ | ||
| Change user roles and status | ✓ | ||
| Delete users | ✓ |
Viewers can use tags and metadata to filter the library and see existing people, faces, and processing results inside an asset. The separate Tags, People, and Jobs pages are available to Editors and Admins. Editing and processing-request controls are hidden for Viewers; media preparation needed for normal viewing remains available.
Editors can organize people and faces by naming people, assigning or unassigning faces, and ignoring detections. Admins control whether visual indexing is enabled for the organization and manage storage capacity and connection tests. Comments and reactions retain their existing ownership restrictions.
File requests have their own upload access setting. Anyone with the link accepts uploads from logged-out visitors and signed-in Viewers. Editors and Admins requires a signed-in Editor or Admin in the owning organization. Neither mode gives uploaders permission to browse the organization’s library.
Signup
Section titled “Signup”When a new organization is created through the signup page, the first account becomes the organization’s Admin. That admin can invite teammates, manage roles, and send password resets from the Users page.
Managing Users
Section titled “Managing Users”Admins can manage users from the Users page in the navigation bar.
From this page you can:
- Create users — set their name, email, password, and role
- Edit users — change roles or update user details
- Delete users — remove a user with a confirmation dialog
- View user status — see who is active, pending, or suspended
- Track last login — monitor user activity
- Sort the user list — sort by user, role, status, last login, last session, or created date
- Send password resets — help users regain access without changing their password directly
Last Session shows the most recent activity Grail has recorded for a user’s session, while Last Login shows the most recent sign-in.