Every staff member holds exactly one role, and the role decides what they can reach. A role only ever grants abilities — there are no “deny” rules to untangle.
The roles
| Role | Intended for | What it can do by default |
|---|---|---|
| Owner | The person accountable for the church’s account | Everything, including billing, removing staff and deleting the organization |
| Admin | Whoever runs the church day to day | Nearly everything an Owner can, except billing, removing staff, deleting the organization and creating another organization |
| Pastor | Pastoral staff | People (add and edit), groups, events and plans, prayer, volunteers, messaging and broadcasts, media, live translation, the community feed and Marketplace moderation, plus giving donations — can see but not change the organization’s settings; creating giving campaigns, importing and deleting are left to Admins |
| Communications | Whoever sends the church’s messages | Messaging and broadcasts, people (add and edit) and groups, the community feed, live translation and Marketplace moderation — read-only on most other areas |
| Media | The media and production team | Media, live translation, the community feed and Marketplace moderation — read-only elsewhere |
| Staff | General staff with no specific remit | Read-only on most of the workspace; no Prayer Requests, Live Translation, Community or Marketplace |
| Volunteer | Volunteers who need to see, not change | Same as Staff |
| Marketplace Moderator | Whoever polices listings | Marketplace moderation, and almost nothing else |
| Member | Your congregation | The app; no portal access at all |
Owner
Intended for:The person accountable for the church’s account
What it can do by default:Everything, including billing, removing staff and deleting the organization
Admin
Intended for:Whoever runs the church day to day
What it can do by default:Nearly everything an Owner can, except billing, removing staff, deleting the organization and creating another organization
Pastor
Intended for:Pastoral staff
What it can do by default:People (add and edit), groups, events and plans, prayer, volunteers, messaging and broadcasts, media, live translation, the community feed and Marketplace moderation, plus giving donations — can see but not change the organization’s settings; creating giving campaigns, importing and deleting are left to Admins
Communications
Intended for:Whoever sends the church’s messages
What it can do by default:Messaging and broadcasts, people (add and edit) and groups, the community feed, live translation and Marketplace moderation — read-only on most other areas
Media
Intended for:The media and production team
What it can do by default:Media, live translation, the community feed and Marketplace moderation — read-only elsewhere
Staff
Intended for:General staff with no specific remit
What it can do by default:Read-only on most of the workspace; no Prayer Requests, Live Translation, Community or Marketplace
Volunteer
Intended for:Volunteers who need to see, not change
What it can do by default:Same as Staff
Marketplace Moderator
Intended for:Whoever polices listings
What it can do by default:Marketplace moderation, and almost nothing else
Member
Intended for:Your congregation
What it can do by default:The app; no portal access at all
These are the defaults. Owners and Admins can change what a built-in role does (except Owner) in Permissions Management, so your church’s roles may differ from this table.
Choosing one
Grant the narrowest role that lets someone do their job. Two habits are worth keeping:
- Keep Owners few. An Owner can delete the organization and change billing. Most people who "need full access" actually need Admin.
- Start read-only. Staff and Volunteer see the workspace without being able to change it, which is usually right for someone new.
Custom roles
If none of the built-in roles fits, click Create role in Roles Management and choose exactly the abilities you want. Built-in roles cannot be renamed or deleted, but you can change what any of them except Owner can do in Permissions Management. Change a built-in role only when you mean it for everyone who holds it; a custom role is usually the cleaner answer.