# Permissions explained

_How roles, item sharing, and public links combine into what someone can see._

Canonical: https://snoze.dev/help/permissions-explained/

What someone can do in Snoze is always the combination of two things: their
**role** in the workspace and the **sharing** on each item. The rule that
makes everything predictable:

> On any single item, someone gets the higher of what their role gives them
> everywhere and what that item is shared with them at. Workspace-wide powers —
> billing, members, building automations — come from the role alone and can't
> be handed out per item.

## The layers

1. **Role** — where everyone starts on every item.
   [Six built-in roles](https://snoze.dev/help/invite-teammates-and-roles/), from Owner down to
   Viewer.
2. **Item sharing** — who an item is shared with and at what level: **Full
   access**, **Can edit**, **Can run**, **Can comment**, or **Can view**.
   Nesting follows the tree: items inherit from their parent until you set
   sharing explicitly.
3. **Public links** — a separate, read-only door for people outside the
   workspace. A [public link](https://snoze.dev/help/share-with-a-public-link/) exposes that
   item only, and only for viewing.

## How questions resolve

- _Can they see it?_ Only if the item (or an ancestor) is shared with them —
  membership alone doesn't reveal private items.
- _Can they edit it?_ If their role allows editing and they can see it, or if
  the item itself is shared with them at **Can edit** or above. A viewer with
  an edit share on one database edits that database and nothing else.
- _Can they run it?_ Operators and everyone above them run the actions shared
  with them. A viewer needs the item shared at **Can run** or higher.
- _Can they build?_ Creating actions and automations, managing members, and
  billing are role-only. No amount of sharing grants them.
- _Can the assistant or an automation touch it?_ Only with the permissions
  of the person asking — automated work never escalates access.
  [Approvals and safety](https://snoze.dev/help/approvals-and-safety/) has the details.

## Checking an item

Open **Share** on any item to see exactly who has access and through what —
direct shares, inheritance from a parent, or a public link. That panel is the
answer to "why can (or can't) they see this?".

> [!TIP]
> Structure private-by-default work under a private parent page. Everything
> you create inside inherits privacy, and sharing the parent later shares the
> whole finished bundle at once.