Roles & Permissions
The seven built-in roles in a Horizon organization, the actions reserved for owners and admins, how to change someone's role, and how roles apply to API keys.
Every member of a Horizon organization has one role, and the role decides which administrative actions they can take.
Built-in roles
Horizon has seven roles:
| Role | Stored as |
|---|---|
| Owner | owner |
| Admin | admin |
| Department Lead | department_lead |
| Member | member |
| Billing Admin | billing_admin |
| Controller | controller |
| Accountant | accountant |
- When you invite someone, you can give them any role except Owner.
- An owner cannot be deactivated.
- Controller and Accountant matter in Finance, where some steps need a particular role. The Finance guides say which, for example Ledger cutover.
What owners and admins can do
These actions are open to owners and admins only:
| Action | Where |
|---|---|
| Invite people, change roles, deactivate and reactivate members | Settings > Users |
| Change the organization’s name, description, logo and color | Settings > General |
| Switch Operator Chat on or off | Settings > General |
| Create, rotate and revoke API keys | Settings > API Keys |
| Allow or stop guest access, and revoke guests | Settings > Guest Access |
| Set where Slack and Teams notifications are posted | Settings > Notifications |
| Turn segregation of duties on or off | Settings > Workspace |
| Edit the company profile | Company > Profile |
| Set up the Navigator and generate altitude checks | Company > Navigator, Company > Altitude Checks |
| Open any department’s dashboard | Dashboard |
Every role can create and edit goals and milestones. What someone can do on a board depends on their role on that board; see Boards.
Changing a role
In Settings > Users, select Edit Role on the member’s row, pick the new Role, and select Save. The change takes effect at once. See User Management.
API and programmatic access
Only an owner or admin can create and manage API keys. A key acts as the person who created it: it can do no more than its own module permissions allow, and anything that depends on a role checks that person’s current role.
Removing that person from the organization does not revoke their keys, so revoke or delete them yourself.