Roles and effective access
Current workspace roles, authoritative identity context, platform-admin boundaries, and intentionally unsupported access paths.
On this page
Task and prerequisites
Use this guide to understand a denied action or review a person's workspace access. You need normal sign-in and current workspace membership.
Access administration requires the authorized workspace administrator. Financial records and named personal data can require additional capability-specific grants.
Owning a resource or cost center does not automatically authorize every amount, person or export.
Current role model
The authenticated Clerk organization role is authoritative. Admin and Member are the current workspace roles; owner status is tracked separately.
Permission simulation
The in-product simulator explains the documented role model only. It does not grant access, bypass backend authorization, or certify a provider permission.
Unsupported access paths
The current workspace role model does not provide arbitrary custom roles, direct permission overrides or temporary elevation. Optional Directory Sync must be separately configured and accepted; it does not bypass capability grants.
Platform-admin access is a separate allowlisted, cross-tenant, read-only support boundary.
Steps and expected result
Confirm the active workspace, open the relevant record and read its access message. Ask the administrator to inspect current membership, role and any required grant through the authorized controls.
Treat an invitation or requested role change as pending until the authoritative identity or backend result confirms it. Retest the exact page and export after confirmation.
Expected access is limited to the approved workspace and population, not every record associated with a familiar owner name.
Limitations and troubleshooting
A permission simulator explains the model but cannot certify live membership or provider access. If a change appears complete in the browser but access is still denied, check the authoritative membership state and the current session through normal sign-in.
Do not supply another organization ID, spoof a role or use a shared link as a bypass. Send support the page and safe failure reference, without tokens or private record contents.