> For the complete documentation index, see [llms.txt](https://docs.podigee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podigee.com/documentation/grow-and-monetize/monetization/concepts-and-reference/role-and-permission-reference.md).

# Role and permission reference

Choose the least-privilege role, scope, and review separation for solo operators, studios, networks, and Marketplace teams.

Roles define what a person can do. Scope defines which records the person can access. Review rules define when another person or the same authorized operator must confirm a high-impact action. Use all three controls together.

![The current One Podigee role assignment confirmation shows the selected role, scope, access period, and review before saving access.](https://2032417310-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbqUKO6lljHGzkEAzliPI%2Fuploads%2Fgit-blob-90be7c265fb3151f1de1e88e8d4450beda7d975e%2Fdoc-monetization-017-review-role-assignment.png?alt=media)

*A role assignment combines responsibility, scope, period, and review.*

## Standard roles

| Role                        | Use it for                                                         | Main responsibility                                                |
| --------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------ |
| **Monetization operator**   | Daily campaign, Creative, Inventory, delivery, and report work.    | Plan, prepare, inspect, and operate within the assigned scope.     |
| **Workspace administrator** | Access, workspace governance, policy, and protected configuration. | Manage people, roles, scope, review rules, and protected settings. |

The standard operator role is broad enough for regular ad operations. Limit its scope when a person works only with selected Commercial accounts, Campaigns, shows, or Inventory.

## Scope choices

| Scope                                | Use it when                                                                  | Effect                                          |
| ------------------------------------ | ---------------------------------------------------------------------------- | ----------------------------------------------- |
| **Entire Monetization workspace**    | The person works across all current and future records.                      | The role applies across the workspace.          |
| **Selected areas**                   | The person works with named accounts, Campaigns, shows, inventory, or teams. | The role applies only to the selected records.  |
| **Time-limited access**              | A contractor, reviewer, or incident operator needs temporary access.         | Access ends at the displayed boundary.          |
| **Business-unit or portfolio scope** | A network separates shows or commercial teams.                               | The person can work only in the assigned group. |

An account with no access to a record cannot use a role permission to reach it. Scope is a boundary, not a filter that only hides records.

## Common job profiles

| Job                        | Typical role and scope                                               | Review note                                                                             |
| -------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Solo publisher             | Monetization operator, entire workspace.                             | Use solo confirmation or optional review for actions that do not need separation.       |
| Production studio operator | Monetization operator, selected shows or Campaigns.                  | Separate Campaign planning from finance or access management when practical.            |
| Network ad operator        | Monetization operator, portfolio or business-unit scope.             | Use independent review for publication, pricing, and high-impact changes when required. |
| Finance operator           | Custom or finance-focused role, finance scope.                       | Keep invoice, payout, and Settlement decisions separate from Creative changes.          |
| Integration operator       | Custom or integration-focused role, selected destinations.           | Limit provider credentials, connector activation, and external delivery scope.          |
| Marketplace operator       | Monetization operator or custom role, Marketplace and partner scope. | Separate partner terms, demand policy, and finance approval when needed.                |
| Support operator           | Read-focused custom role, assigned support scope.                    | Allow evidence export only with redaction and expiry controls.                          |

These are patterns, not required organizational structures. A small team can use fewer roles when the workspace review rule and audit evidence remain clear.

## Sensitive actions

Treat these actions as high impact:

* grant, change, or revoke access;
* publish or revoke a Campaign delivery setup;
* change pricing, CPM, currency, or commercial terms;
* change targeting, brand safety, frequency, pacing, or fallback rules;
* activate or suspend an external demand or destination connection;
* change finance authority, tax, or accounting rules;
* approve or issue an invoice;
* approve a publisher payout;
* close a Settlement period;
* export portable state or sensitive evidence.

Give only the permission needed for the job. Do not add access management or finance authority to a daily operator role only because the person needs to publish a Campaign.

## Review separation

The workspace can use these review modes for each action family:

* **No approval required:** The authorized operator can continue.
* **Optional review:** A teammate can advise without blocking the action.
* **Solo confirmation:** One authorized operator confirms the exact action.
* **Independent review:** A different authorized person must decide the exact version.

The configured rule appears on the action. The rule can differ for Campaign terms, publication, Creative review, finance, integrations, or access. A person must not approve their own action when the rule requires an independent reviewer.

## Custom roles

Create a custom role when a standard role is too broad or cannot complete the defined job. Use the smallest permission set that passes these tests:

1. The person can complete the normal task.
2. The person cannot view or change records outside the scope.
3. Protected actions remain unavailable when they are not part of the job.
4. Review rules still apply.
5. The person can read the receipt and evidence needed to prove the job.

Publish a successor role version when the permission set changes. Existing assignments keep their current version until you change them.

## Access lifecycle

| Action                  | Result                                                               |
| ----------------------- | -------------------------------------------------------------------- |
| **Give access**         | Creates a new role, scope, and time boundary.                        |
| **Change access**       | Creates a new assignment version for the person.                     |
| **Temporarily suspend** | Stops use while preserving the assignment history.                   |
| **Revoke access**       | Stops access permanently for the selected assignment.                |
| **Restore access**      | Creates a current assignment after the reason and scope are checked. |

Refresh the People and access list after a change. Confirm the effective role, scope, and status.

## If a person cannot complete a task

Check in this order:

1. The person has access to Monetization.
2. The role includes the required action.
3. The selected record is inside the role scope.
4. The access period is current.
5. The review rule is satisfied.
6. The record itself is ready and current.

Do not solve a missing permission by giving the entire workspace. Add one approved permission or expand the scope only when the job requires it.

## Expected result

Each person has the smallest role and scope that supports the job. Solo operators can work without unnecessary handoffs, larger teams can separate high-impact decisions, and every sensitive action keeps a clear permission, scope, and review boundary.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.podigee.com/documentation/grow-and-monetize/monetization/concepts-and-reference/role-and-permission-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.