Roles and permissions

What it is

Every member of your workspace has exactly one role. The role decides which parts of the CSR workspace they can open and whether they can change anything there. Everyone, whatever their role, can still volunteer through the employee app.

Clear roles matter because CSR spending, NGO registrations and funding decisions are reviewed by the CSR Committee, internal audit and statutory auditors, and sometimes an assurance provider. You can give reviewers read-only access without sharing an admin login.

What you can use it for

• Owner: everything, including Plan and billing, Integrations and Branding. Only owners can make or change other owners.
• CSR admin: runs the CSR programme: activities, approvals, budget, NGOs, CSR compliance, reports, people and settings. Counts toward your CSR-admin limit.
• Coordinator: runs activities, campaigns, hours approvals, leave approvals and announcements, and can view feedback and impact metrics. No budget, people, billing or settings. Can be limited to a brand, country or department.
• Auditor: read-only reviewer of the overview, activities, campaigns, approvals, requests, NGOs, budget, photos, impact metrics, ESG report and audit log. Cannot see the People list, settings, billing or integrations.
• Line manager: sees their team's hours and participation in My team, plus their own volunteering. No CSR workspace.
• Employee: joins activities, logs hours, requests volunteer leave and sees their own impact.

How to do it

Change someone's role

1. Open the personGo to CSR workspace → People and select the person's name.
2. Choose the rolePick a new value in Role. Only owners see the Owner option.
3. SaveSelect Save. The change is written to the audit log with the old and new role.

Limit a coordinator to a scope

1. Set the role to CoordinatorOpen the person, choose Coordinator and save.
2. Fill in Coordinator scopeUnder Coordinator scope, choose a Brand (Enterprise), Country and/or Department. Leave a field on Any for no limit on it.
3. Save and checkSelect Save. The coordinator now sees and approves only activities, people and hours inside that scope.

Give an external reviewer read-only access

1. Invite them as AuditorOn People, use Invite someone and choose the role Auditor.
2. Tell them what to expectWhen they sign in, a banner reminds them they have read-only access. They can view and export the ESG report and the audit log, but cannot change anything.

Tips and good practice

• Scope rules: an activity is in scope when its brand and country match the coordinator's scope, or when the coordinator created it. People are in scope when brand, country and department all match. Department scope does not limit activities, because activities have no department.
• Campaigns are company-wide. Coordinators can create and edit them, but delete only the campaigns and announcements they created.
• Use coordinators for country or brand teams instead of extra CSR admins: they do not use CSR-admin seats.
• You cannot remove your own admin access or deactivate yourself. Ask another owner or admin.

Questions