# Roles and data restrictions

A role in AdPix is not a title, it is a level of authority. Separately, four restrictions sit on the membership itself — and separately again, the property's plan decides whether a screen opens at all.

## A role is a level, not a title

Every role is a number, and every action in AdPix requires a minimum number. Reach it and the action runs; fall short and the answer is a 403. There is no separate list of tick boxes anywhere.

| Role | What it adds over the row above |
| --- | --- |
| Viewer | Read reports and settings |
| Analyst | Author reports, explorations, segments, custom definitions, annotations, the library |
| Marketer | Audiences, events and key events, attribution, alerts, property-scoped channel rules |
| Editor | Property settings, data streams, tags, data collection, cost import, keys |
| Property admin | Member management for that property |
| Account admin | Account settings and members, creating, deleting and restoring properties, Trash |
| Org admin | The same authority as Account admin, across every account and property in the organization |
| Org owner | Organization settings, organization member management, permanent erasure of one person's data |

Roles are cumulative: each row also holds everything above it. At the organization level one more role can be granted, **Org member**, which sits just above Viewer and is used for basic membership in the organization.

Org admin and Org owner are not the same thing: an Org admin ranks exactly where an Account admin does — only across the whole organization — and organization-scope actions, from managing organization members to raising an erasure request, need the Org owner.

A person's effective authority on a property is the **highest** role reaching them by three routes — a membership on the property, on the account above it, or on the organization. Removing a role from one property changes nothing if the same person is also a member at the organization level.

> **The grant ceiling**
>
> Nobody may grant, invite or remove a role above their own effective role at that scope. A property admin cannot create an org owner.

## Four restrictions that are independent of the role

Data restrictions sit on the membership, not on the role. The first two are **closed** by default, the last two are **open**.

| Restriction | Default | What it does when applied |
| --- | --- | --- |
| Raw data | Closed | Event-level reads and raw export stay closed |
| User identifiers | Closed | The global user id, email, phone and other identity fields are masked in reports |
| Cost metrics | Open | Cost and ROAS columns come back empty |
| Revenue metrics | Open | Revenue columns come back empty |

Resolution is simple, and cautious in both directions: for cost and revenue the **most restrictive** applicable membership wins; for raw data and user identifiers, closed is the default and only an explicit lift on one of the memberships opens it.

There is one deliberate exception: **Property admin and above — property admin, account admin, org admin, org owner — see their own business's user identifiers** without anyone lifting a flag. They administer that property, and every identifier read is already bound to their own organization and property. For editors and below the default stays closed.

The access panel in the console grants and changes the role only; the four restrictions are carried on the membership record and are set through the access API. An account or property admin can set the cost and revenue restrictions on a member; lifting the two sensitive ones — raw data and user identifiers — is a platform administrator's action alone.

## Two screens no business role reaches

The raw event stream and the identified-user list are open to AdPix platform administrators only — even if both restrictions on your membership have been lifted. They expose the full event payload and the identity pool, and they do not open for any business-level role.

Lifting a restriction on a membership still does its job: it removes **field-level** masking wherever a business can reach — the user breakdown in heatmap reports, or the live visitor feed, for example. It just does not unlock those two screens.

> **Sensitive reads are recorded**
>
> Every time user identifiers or raw data are actually read, a row marked **sensitive** is written to the audit log. Those rows also appear in **Property change history**, alongside settings changes.

## Holding the capability is not the same as seeing the screen

This is the one that generates the most tickets. On top of the role, every advanced feature is also tied to the plan of **the property currently selected at the top of the console**.

- A feature that is not in the plan catalogue is always available — the base product stays free.
- A feature that is in it opens when the property's plan includes it.
- There is also a global kill switch that, when set, closes a feature for everyone, platform administrators included.

When you hold the role but the plan does not include the feature, the page opens and shows "{feature} is a premium feature" with an **Upgrade plan** button instead of the report. Such a feature also appears in the navigation with a premium marker, unless it has been hidden.

Outside the Free plan by default: Marketing Mix, Lift, Fraud Protection, Heatmaps, Reports & Explore, Library, and Audiences. The rest of the menu — Realtime, Acquisition, Traffic acquisition, Engagement, E-commerce, Funnel, Demographics, Tech, Path, Segment overlap, Cookie consent and Alerts — is in both plans.

> **The plan belongs to the property, not to you**
>
> With several properties, the same feature can be open on one and locked on another. Check the picker at the top of the page before anything else.

## When an organization is closed

If AdPix suspends an organization or disables its platform access, every member's effective authority across that organization's whole subtree drops to zero — reports, settings, keys, all at once. It is enforced at the same point every guarded request passes through, so there is no way around it.

Collection does not stop; reading does.

## Where you see this in the console

Admin → Property settings → **Property access management** lists a property's members, and Account settings → **Account access management** lists the account's. Rows marked **inherited** come from a higher level and are managed there. The three-level structure is described in [organizations, accounts and properties](concepts/foundations/organization-hierarchy).

## Frequently asked questions

### Why is a page locked when I have access to it?

Because the role and the plan are two different things. Your role grants the capability to read reports, but some features are also tied to the plan of the property selected at the top of the console. If that property is on the Free plan, the page shows a premium notice instead of the report. Switch property or upgrade the plan.

### Why are my cost or revenue columns empty?

A cost or revenue restriction is set on your membership. Both are off by default, so someone turned it on deliberately. If you hold membership by more than one route, the most restrictive one wins.

### Why can I not see visitor emails and phone numbers?

User identifiers are closed by default. Property admin and above see their own business's identifiers; editors and below see masked values until the restriction is lifted on their membership, and only a platform administrator can lift it.

### Can I grant someone a role above my own?

No. Nobody can grant, invite or remove a role that outranks their own effective role at that scope. That is what stops a property admin from minting an org owner and then evicting the person who granted it.

## Related

- [Organizations, accounts and properties](https://docs.adpix.io/en/concepts/foundations/organization-hierarchy/)
- [Roles and capabilities](https://docs.adpix.io/en/analytics/admin/roles-and-capabilities/)
- [A feature is greyed out](https://docs.adpix.io/en/analytics/troubleshooting/a-feature-is-greyed-out/)

---

[Docs](https://docs.adpix.io/en/concepts/governance/roles-and-data-restrictions/) · AdPix