Manage roles and access

DataDoe permissions let you choose what each person can do and which Sellers, Vendors, Actions, and data tables they can use. For example, someone may be allowed to create Exports, but only for selected Sellers and tables.

An Admin must enable advanced permissions before you can change roles and access. Existing team members keep full Admin access until you change their roles. New members receive the limited Organization User role, even before advanced permissions are enabled.

These terms explain how access fits together:

Enable advanced permissions

1. Open Settings, then Permissions (opens in a new tab) as an Admin.
2. Read the Enable advanced permissions notice.
3. Select the confirmation checkbox, then Activate access controls.
4. Review your team's roles and access.

Activation cannot be undone. It lets you edit access settings, but does not automatically restrict existing Admins.

Choose what a role can do

Organization Admin has all available permissions, and its access cannot be reduced. Organization User starts with a limited set of permissions that an Admin can change. Some settings are reserved for Admins or the Organization creator.

You can also create custom Roles for different teams or responsibilities. Users can have several Roles, and their permissions add together. If one Role allows viewing and another allows editing, the User can edit. Choosing None in one Role does not cancel access provided by another.

The permission table has a column for each Role. Use these settings to choose what the Role can do:

Only the choices supported by each permission appear in the table.

Reset AI Tokens lets someone restore the Organization's monthly AI Tokens. In Settings, open Organization. Organization Admins have this permission. Other Roles do not, unless an Admin allows it. Service accounts cannot have it. A reset is shown only after DataDoe adds one for the Organization. Each reset can be used once, before the date and time shown. Purchased token bundles and extra usage stay as they are.

Create or edit a role

1. In Settings, open Permissions, then Roles and permissions.
2. Select Create role and enter a name, or find an existing Role's column.
3. Choose the permission levels the Role needs.
4. Choose All or Selected separately for Sellers and Vendors, Actions, and data tables.
5. If you choose Selected, assign the Role to the accounts, Actions, or tables it needs, as described below.

Changes save immediately. Use Find a permission to filter the table, or scroll horizontally to see more Roles.

The selector in each section header changes every permission in that section for a Role, including permissions hidden by search. Mixed means the section contains different permission levels. Read only leaves on or off permissions disabled; Read & write selects the highest available level. Settings reserved for Admins stay fixed.

Select a custom Role's name above the table to rename or delete it. If it is someone's only Role, choose a replacement before deleting it.

Assign roles to users

1. Open Settings, then Users (opens in a new tab).
2. Select the User you want to manage.
3. Assign the Roles they need and remove any that give them broader access.
4. Check that at least one Role remains, then select Save changes.

You can remove Organization User if the person has another Role. To limit an Admin's access, you must remove their Admin role too. The Organization creator keeps their Admin role, and your Organization must always have an active Admin.

For inviting people and managing their accounts, see Manage users and access.

Choose which accounts, Actions, and tables are available

Permissions and access work together. A User needs permission to perform a task and access to the accounts, Actions, or tables involved.

For each Role or Service account, choose:

• All to include every current and future item of that kind
• Selected to include only the items you assign

For Users, access from all their Roles and individual assignments adds together. A permission from one Role can be used with account or table access from another. Removing an individual assignment does not remove access provided by another Role or an All setting.

Sellers, Vendors, and Groups

On the Sellers & Vendors page, select Access beside a Group or an account that is not in a Group. Add the Users, Roles, or Service accounts that should have access.

A Group gives access to all its current and future members. An account can belong to only one Group, and accounts in a Group use the Group's access settings.

When you add an account to a Group, DataDoe asks you to confirm removal of all direct user, role, and service account assignments, including grants you cannot see. People and integrations relying on those grants may lose access. If you later remove the account from the Group, assign access to the account again. Deleting a Group also removes the access it provided. Anyone with All accounts access keeps access.

See Organize your Sellers and Vendors with Groups for Group management steps.

Actions and data tables

In Settings, open Actions or Data and select Access beside an Action or table. Add the Users, Roles, or Service accounts that need to use it.

Action access controls which Actions someone can use. Table access controls which data they can use. Both also require the relevant general permissions and account access. Tables containing personal information require additional permission.

The same Action and table access applies across all accounts available to that User or Service account. For example, someone with access to an Action and two Sellers can use that Action for either Seller. You cannot allow that Action for only one of those Sellers.

Action access and table access are separate. Access to an Action does not automatically grant access to tables containing similar information.

Access personal data

Access PII data controls access to personal information in tables, Action requests and results, and generated Files. Your Organization must also have Amazon PII Data Access enabled. The usual operation permissions and account, Action, or table assignments still apply. Choosing All tables or All Actions does not bypass these requirements.

New non-Admin Roles and Service accounts start with Access PII data disabled. Existing grants are preserved in Organizations where PII access was already enabled. In Organizations without PII access, previous non-Admin Role and Service account grants are cleared. Enabling PII access for the Organization later does not restore those grants automatically.

The Organization Admin role's PII permission is fixed, but Admins still need PII access enabled for the Organization. A Service account also remains limited by its creator's current PII access.

Manage service account access

Admins can give other Users the Manage service accounts permission. With this permission, open Settings, then Permissions, then Service accounts. Admins can manage every Service account; other Users can see and manage only the ones they created.

Choose the permissions and the Sellers, Vendors, Actions, and tables each Service account needs. You can only assign permissions you have, up to your own level, and resources you can access.

Service accounts have their own settings; you do not assign User roles to them. Their access cannot exceed their creator's current access. Removing the creator's Manage service accounts permission blocks all access through their Service accounts, including existing keys and scheduled work.

Changes affect every integration using that Service account. An integration connected through a person's account follows that person's current access.

For setup and connection instructions, see Manage keys and service accounts.

Review access after changes

Check all of a User's Roles and individual assignments when restricting access. A Role with All access can still give them access to items you removed elsewhere.

Reducing access can also stop scheduled work and integrations that depend on it. Review the accounts, Actions, and tables they need before making changes.

Open Settings, then Usage, to review access changes. Expand an entry's summary to compare its Before and After settings. These entries use zero AI Tokens. See Usage logs for filters and exports.

If you have questions or run into an access issue, contact us using the support form (opens in a new tab).