User Roles¶
ValuePact controls access through two complementary mechanisms: experience tiers and roles. Tiers progressively disclose features in the interface, while roles determine administrative boundaries and data access.
Who this is for¶
Admin Executive End User
Overview¶
Every user in ValuePact is a member of a Clerk organization (tenant). Within that organization, the user has a role that governs what they can view, edit, approve, and administer. The platform also supports tiered disclosure—Standard, Advanced, and Admin modes—that changes which UI surfaces are visible without altering underlying permissions.
Experience tiers¶
The interface adapts to three tiers:
| Tier | Description | How to access |
|---|---|---|
| Standard | Simplified flows for business users. Hides advanced modeling and configuration. | Default for most users. Toggle in the left rail footer. |
| Advanced | Power-user modeling and inspection tools. Exposes formula editing, driver trees, and agent configuration. | Toggle Advanced Mode in the left rail footer. |
| Admin | Governance controls and tenant configuration. Shows user management, billing, audit logs, and integrations. | Gated by role; only Admin and Super Admin users see this tier. |
Note
Users can switch between Standard and Advanced modes using the tier switcher in the left rail footer. Admin capabilities are locked and require the corresponding role.
Roles and permissions¶
Super Admin¶
The highest level of access. Typically reserved for platform owners and tenant creators.
- Full user and role management
- Billing and subscription configuration
- SSO and MFA setup
- API key management
- Audit log access across the organization
- Cross-account data access (bypasses account-level scoping)
- Activate and deactivate industry value packs
- Configure custom fields and workflows
Warning
Super Admin bypasses Row-Level Security (RLS) for operational tasks. All bypass actions are logged in the audit trail.
Admin (Tenant Admin)¶
Day-to-day administrators who manage the organization but do not require full platform control.
- Invite, remove, and deactivate users
- Assign and revoke roles
- Manage teams and groups
- Configure branding and notifications
- View audit logs (read-only)
- Approve business cases for export
- Manage integrations (Salesforce, HubSpot, Slack, etc.)
- Cannot modify billing subscriptions (Super Admin only)
- Cannot delete the organization (Super Admin only)
Executive¶
Senior stakeholders who review portfolios and approved deliverables.
- View executive and portfolio dashboards
- Approve business cases
- View audit logs (read-only)
- Export approved reports
- Cannot edit value models or formulas
- Cannot manage users or settings
- Cannot create or delete accounts
User¶
Standard team members who build value models and deliverables.
- Create and edit prospect accounts
- Use Intelligence and Value Studio workspaces
- Edit variables and formulas (Advanced mode)
- Generate business cases
- Submit cases for approval
- View stakeholders and evidence
- Cannot approve or export business cases
- Cannot access audit logs or governance
- Cannot manage users or integrations
Viewer¶
Read-only access for stakeholders who need visibility without mutation rights.
- View intelligence data (signals, drivers, evidence, stakeholders)
- View approved business cases and deliverables
- View dashboards (team and individual)
- Cannot edit any data
- Cannot create accounts or business cases
- Cannot export deliverables
- Cannot access audit logs
Role-to-workspace mapping¶
| Workspace | Viewer | User | Executive | Admin | Super Admin |
|---|---|---|---|---|---|
| Accounts | View | Create/Edit | View | Full | Full |
| Intelligence | View | Edit | View | Full | Full |
| Value Studio | View | Edit | View | Full | Full |
| Deliverables | View (approved only) | Create/Submit | Approve/Export | Full | Full |
| Governance | — | — | View audit | Full | Full |
| Settings | — | — | — | Full | Full |
| Context Engine | View | View/Use | View | Configure | Full |
Tip
A dash (—) means the workspace is not visible to that role in the left rail.
How roles are assigned¶
- An Admin or Super Admin navigates to Settings > Team & Access.
- Click Invite Members and enter the user's email address.
- Select a role from the dropdown: Viewer, User, Executive, Admin.
- The invited user receives an email and joins the Clerk organization on first sign-in.
Note
Role changes take effect immediately. The user does not need to sign out and back in.
Permissions required¶
| Role | Permission | Scope |
|---|---|---|
| Admin | Assign roles | Organization |
| Admin | Deactivate users | Organization |
| Super Admin | Delete organization | Organization |
| Super Admin | Configure billing | Organization |
Only Super Admin can delete the organization or modify billing details.
Limits and guardrails¶
Limit Maximum 50 Admin users per organization.
Limit Maximum 500 total users per organization on the Standard plan; enterprise tiers support more.
Limit A user can belong to up to 10 Clerk organizations simultaneously.
Limit Role assignment changes are audited. You cannot self-elevate to Admin or Super Admin.
Troubleshooting¶
Issue: I cannot see the Admin tier in the left rail switcher
Cause: Your role is User, Viewer, or Executive. The Admin tier is gated by role, not by toggle. Resolution: Ask an Admin or Super Admin to elevate your role in Settings > Team & Access.
Issue: A new team member sees a blank page after accepting the invite
Cause: The user has not selected an active organization, or the invite was sent to a different email. Resolution: Ask the user to check the Choose a workspace screen after sign-in. If the organization is missing, resend the invite to the exact email address registered with Clerk.
Issue: I changed a user's role but they still see the old UI
Cause: The frontend caches tier and role state for the session duration. Resolution: The user should refresh the browser. If the issue persists, ask them to sign out and sign in again.
Issue: An Executive cannot export a business case
Cause: The case status is draft or the Executive role lacks export permission on unapproved cases. Resolution: Ensure the case is approved. If approved and still blocked, verify the Executive has not been downgraded to Viewer.
Related pages¶
- Navigating the Platform
- Quick Start Guide
- Administration: User Management
- Administration: Role Management
- Administration: Permissions
- Administration: Security
Escalation path¶
If role assignment or access issues persist:
- Verify the user's role in Settings > Team & Access.
- Check the Troubleshooting: Permission Issues guide.
- Open a support ticket with severity S3 and include the affected user email and expected role.
- For suspected tenant isolation violations, escalate to severity S1 immediately.