Roles & Permissions

Muin uses a flexible role-based access control (RBAC) system that lets you give each team member exactly the access they need — no more, no less. You manage it at Settings → Organization → Roles & Permissions.

Understanding the Permission Model

Access in Muin is built from three pieces:

Base roles — every member is an Owner, Admin, or Member. This is the floor.
Roles — named, reusable bundles of permissions you assign to members (for example Finance Viewer or Grants Coordinator). Start from a built-in template or build your own.
Permissions — each role turns on specific actions for specific features (for example Approve on Grant Disbursements).

Base roles set the baseline; roles layer finer, per-feature access on top.

Base Roles

Owner

The workspace owner has complete control over the organization:

Full access to all modules and features
Manage billing and subscription
Transfer ownership to another user
Delete the workspace
Cannot be removed from the workspace

Use for: Business owners, company founders, primary account holders.

Admin

Administrators have broad access but cannot perform destructive workspace operations:

Full access to all modules
Manage users, invitations, roles, and permissions
Configure all settings
View audit logs
Cannot manage billing or delete the workspace

Use for: IT administrators, operations managers, team leads who need to manage the platform.

Member

Members have access based on the roles assigned to them:

Access determined by the roles they hold
Cannot manage users or workspace settings unless granted
Default role for most team members

Use for: Regular employees, department staff, contractors.

Roles

A role is a named, reusable bundle of permissions. Assign a role to one member or many; update the role once and every assignee’s access updates with it. Roles come from three places:

Starter templates — built-in roles Muin ships for common jobs. They’re ready to assign as-is, and Muin recommends the ones that fit your organization.
Custom roles — roles you build from scratch, turning on exactly the permissions you want.
Cloned roles — a copy of a template you edit to fit your needs. (Templates themselves are read-only — clone one to make an editable version.)

Starter Templates

Muin ships ready-to-use role templates so you rarely have to start from scratch, including:

Template	For
Org Admin	Broad administrative access across the organization
Finance Viewer	Read-only visibility into financial data and reports
Calendar Coordinator	Managing events and the shared calendar
Volunteer Coordinator	Managing volunteers, programs, and shifts
Volunteer Reimbursement Approver	Approving volunteer reimbursements
Grants Coordinator	Day-to-day grant intake and coordination
Grant Program Manager	Running a grant program end to end
Grant Reviewer	Reviewing and scoring grant applications
Grant Disbursement Approver	Approving grant payouts (approval only)
Grant Compliance Officer	Grant compliance and reporting oversight
Aid Disbursement Approver	Approving aid & assistance disbursements
Front-Desk / Data Entry	Front-desk intake and basic record entry

In the app, the Roles & Permissions page highlights Recommended for your organization and lists All starter templates below it.

Permissions

Each role grants actions on features. A feature is a specific capability (for example Expenses, Grant Applications, Documents, Broadcasts). For each feature, a role can grant any combination of six actions:

Action	What it allows
View	See the feature’s data — lists, details, and reports
Create	Add new records
Edit	Change existing records
Delete	Remove records
Manage	Full control of the feature, including its configuration
Approve	Authorize/release an item — used for money-movement and other high-risk steps

Approve is a separate grant from Manage. Managing a feature does not automatically let someone approve. This lets you separate who runs a process from who signs off on the money — for example, a Grants Coordinator can prepare a disbursement while only a Grant Disbursement Approver can release it.

Only features for modules your workspace has enabled appear here. Enable modules under Settings → Modules to grant access to them.

Building & Editing Roles

Open Settings → Organization → Roles & Permissions.

Start from a template

Find the template under Recommended for your organization or All starter templates.
Click Assign to use it as-is, or Clone & edit to make an editable copy first.

Build a custom role

Click Create role (or Build from scratch).
Give the role a name and optional description.
Under What this role can do, turn on exactly the permissions it should grant using the plain-language toggles. A live summary updates as you go.
For fine-grained control, open the advanced matrix to set individual feature × action grants.
Click Save changes.

Templates are read-only; to change one, use Clone to edit and modify the copy.

Assigning Roles to Members

Navigate to Settings → Organization → Team (or open a member from the Team page).
Open the member and assign one or more roles.
Save. Changes take effect on the member’s next page load — no logout required.

To manage everyone assigned to a particular role, open the role and choose Manage assignments. A role can’t be deleted while people are still assigned to it — unassign them first.

Example Configurations

Finance lead

Assign the Finance Viewer template for read access, plus a custom role granting Manage (and Approve where they sign off) on the finance features they own.

Grants team with separated approval

Grants Coordinator — prepares applications and disbursements (Create/Edit/Manage on grant features).
Grant Disbursement Approver — holds only Approve on grant disbursements, so payouts require a distinct sign-off.

Read-only viewer

Build a custom role granting only View on the features someone needs to see, and nothing else.

UI Behavior

Permission-aware buttons

When a member lacks permission for an action:

Buttons appear disabled with reduced opacity.
Tooltips explain the permission they’d need.
Members see what they can’t do without hitting errors.

Hidden vs disabled

No access to a feature → it’s hidden from navigation.
Insufficient action → the button is visible but disabled with a tooltip.

This reduces confusion while maintaining security.

Real-time updates

Permission changes apply on the member’s next page load — no logout/login required.

API-Level Enforcement

Permissions are enforced at the API layer, not just in the UI:

Every request is authorized against the caller’s effective permissions.
Unauthorized actions return 403 Forbidden.
Frontend and backend both enforce, and audit logs capture attempts.

Even if a member bypasses the UI, the API rejects actions they aren’t granted.

Best Practices

Principle of least privilege

Give members the minimum access needed. Start from View, and grant Manage/Approve only where the job requires it.

Prefer roles over one-offs

Assign shared roles instead of configuring each person individually — updating the role updates everyone who holds it.

Separate approval from management

For money-movement and other high-risk features, keep Approve on a dedicated approver role so no single person can both run and release a payout.

Regular audits

Review who holds which roles monthly.
Remove roles when someone’s responsibilities change.
Use audit logs to verify appropriate access.

Troubleshooting

A member can’t access an expected feature

Check their base role.
Check which roles they’re assigned and what those roles grant.
Confirm the feature’s module is enabled (Settings → Modules).
Check whether the feature requires a subscription tier.

Permission changes not taking effect

Ensure the role change was saved.
Ask the member to refresh the page.
Confirm the role is actually assigned to them.

Can’t find role controls

Only Owners and Admins can manage roles.
Navigate to Settings → Organization → Roles & Permissions.

Next Steps

Team Management - Invite and manage users
Audit Logs - Track activity
Security Settings - Organization security