Falaah Falaah AI

Roles & Permissions

Comprehensive guide to Muin's role-based access control (RBAC). Learn how to use starter role templates, build custom roles, and grant per-feature permissions.

Muin uses a flexible role-based access control (RBAC) system that lets you give each team member exactly the access they need, no more, no less. You manage it at Settings → Organization → Roles & Permissions.

Understanding the Permission Model

Access in Muin is built from three pieces:

  1. Base roles: every member is an Owner, Admin, or Member. This is the floor.
  2. Roles: named, reusable bundles of permissions you assign to members (for example Finance Viewer or Grants Coordinator). Start from a built-in template or build your own.
  3. Permissions: each role turns on specific actions for specific features (for example Approve on Grant Disbursements).

Base roles set the baseline; roles layer finer, per-feature access on top.

Base Roles

Owner

The workspace owner has complete control over the organization:

  • Full access to all modules and features
  • Manage billing and subscription
  • Transfer ownership to another user
  • Delete the workspace
  • Cannot be removed from the workspace

Use for: Business owners, company founders, primary account holders.

Admin

Administrators have broad access but cannot perform destructive workspace operations:

  • Full access to all modules
  • Manage users, invitations, roles, and permissions
  • Configure all settings
  • View audit logs
  • Cannot manage billing or delete the workspace

Use for: IT administrators, operations managers, team leads who need to manage the platform.

Member

Members have access based on the roles assigned to them:

  • Access determined by the roles they hold
  • Cannot manage users or workspace settings unless granted
  • Cannot read form submissions (aid, grant, vendor and volunteer applications) unless a role grants View on Form Submissions, as Org Admin and Manager do
  • Default role for most team members

Use for: Regular employees, department staff, contractors.

Roles

A role is a named, reusable bundle of permissions. Assign a role to one member or many; update the role once and every assignee’s access updates with it. Roles come from three places:

  • Starter templates: built-in roles Muin ships for common jobs. They’re ready to assign as-is, and Muin recommends the ones that fit your organization.
  • Custom roles: roles you build from scratch, turning on exactly the permissions you want.
  • Cloned roles: a copy of a template you edit to fit your needs. (Templates themselves are read-only: clone one to make an editable version.)

Starter Templates

Muin ships ready-to-use role templates so you rarely have to start from scratch, including:

Template For
Org Admin Broad administrative access across the organization
User Administrator Helping people with their accounts: invite members, set access levels and roles, unlock a locked-out account, send a password-reset email, suspend or reactivate. Cannot set a password directly or transfer ownership. Assign this instead of making your front-desk lead or IT volunteer a full Admin.
Audit Trail Reviewer Reviewing the audit trail under Administration → Audit & Security: sign-ins, permission changes, configuration, document, payment and AI activity, and who viewed sensitive or health (PHI) records. Read-only: cannot export logs or change retention. Assign this to a compliance officer instead of making them a full Admin.
Finance Viewer Read-only visibility into financial data and reports
Calendar Coordinator Managing events and the shared calendar
Volunteer Coordinator Managing volunteers, programs, and shifts, and reviewing volunteer applications. Covers your volunteer application form only, never any other form’s submissions.
Facilities Manager Running facility rentals: spaces, rate cards, bookings and approvals, the waitlist and rental settings, and reading rental requests. Covers your facility rental request forms only, never any other form’s submissions.
Employee Building and submitting forms. Cannot open or change other people’s form submissions.
Volunteer Reimbursement Approver Approving volunteer reimbursements
Grants Coordinator Day-to-day grant intake and coordination
Grant Program Manager Running a grant program end to end
Grant Reviewer Reviewing and scoring grant applications
Grant Disbursement Approver Approving grant payouts (approval only)
Grant Compliance Officer Grant compliance and reporting oversight
Aid Disbursement Approver Approving aid & assistance disbursements
Front-Desk / Data Entry Front-desk intake and basic record entry
Kiosk Operator Running kiosks: starting a quick kiosk session on their own phone in the Muin app, setting up lobby tablets with Set up this tablet or a setup code, and seeing the device fleet, including who started each quick session. Its two kiosk permissions read Kiosk · Can start a quick kiosk session and Kiosk · Can set up kiosk tablets. Cannot edit menus, boards or devices.

In the app, the Roles & Permissions page highlights Recommended for your organization and lists All starter templates below it.

Roles suggested by what you own

Each Business Module you own names the starter roles it creates. When you invite someone, these appear first under Suggested for and the module’s name:

Module Suggested roles
HR Employee, Manager
Finance Finance Officer, Finance Viewer
Compliance Compliance Manager
Non-Profits Program Director, Volunteer Coordinator
Spend Procurement Manager, Vendor Manager

Products and Solutions suggest roles too:

Product or Solution Suggested roles
Online Giving Giving Manager
Space Rentals Facilities Manager
Compliance Solution Compliance Manager
Grants Solution Grants Coordinator, Grant Compliance Officer
Facilities Solution Facilities Manager
Spend Management Solution Procurement Manager, Vendor Manager

See Team Management.

Permissions

Each role grants actions on features. A feature is a specific capability (for example Expenses, Grant Applications, Documents, Broadcasts). For each feature, a role can grant any combination of six actions:

Action What it allows
View See the feature’s data: lists, details, and reports
Create Add new records
Edit Change existing records
Delete Remove records
Manage Full control of the feature, including its configuration
Approve Authorize/release an item: used for money-movement and other high-risk steps

Approve is a separate grant from Manage. Managing a feature does not automatically let someone approve. This lets you separate who runs a process from who signs off on the money: for example, a Grants Coordinator can prepare a disbursement while only a Grant Disbursement Approver can release it.

Only features for modules your workspace has enabled appear here. Enable modules under Settings → Modules to grant access to them.

Building & Editing Roles

Open Settings → Organization → Roles & Permissions.

Start from a template

  1. Find the template under Recommended for your organization or All starter templates.
  2. Click Assign to use it as-is, or Clone & edit to make an editable copy first.

Build a custom role

  1. Click Create role (or Build from scratch).
  2. Give the role a name and optional description.
  3. Under What this role can do, turn on exactly the permissions it should grant using the plain-language toggles. A live summary updates as you go.
  4. For fine-grained control, open the advanced matrix to set individual feature × action grants.
  5. Click Save changes.

Templates are read-only; to change one, use Clone to edit and modify the copy.

Assigning Roles to Members

  1. Navigate to Settings → Members (/settings/members), or open a member from that page.
  2. Open the member and assign one or more roles.
  3. Save. Changes take effect on the member’s next page load, no logout required.

To manage everyone assigned to a particular role, open the role and choose Manage assignments. A role can’t be deleted while people are still assigned to it: unassign them first.

Example Configurations

Finance lead

Assign the Finance Viewer template for read access, plus a custom role granting Manage (and Approve where they sign off) on the finance features they own.

Grants team with separated approval

  • Grants Coordinator: prepares applications and disbursements (Create/Edit/Manage on grant features).
  • Grant Disbursement Approver: holds only Approve on grant disbursements, so payouts require a distinct sign-off.

Read-only viewer

Build a custom role granting only View on the features someone needs to see, and nothing else.

UI Behavior

Permission-aware buttons

When a member lacks permission for an action:

  • Buttons appear disabled with reduced opacity.
  • Tooltips explain the permission they’d need.
  • Members see what they can’t do without hitting errors.

Hidden vs disabled

  • No access to a feature → it’s hidden from navigation.
  • Insufficient action → the button is visible but disabled with a tooltip.

This reduces confusion while maintaining security.

Real-time updates

Permission changes apply on the member’s next page load, no logout/login required.

API-Level Enforcement

Permissions are enforced at the API layer, not just in the UI:

  • Every request is authorized against the caller’s effective permissions.
  • Unauthorized actions return 403 Forbidden.
  • Frontend and backend both enforce, and audit logs capture attempts.

Even if a member bypasses the UI, the API rejects actions they aren’t granted.

Best Practices

Principle of least privilege

Give members the minimum access needed. Start from View, and grant Manage/Approve only where the job requires it.

Prefer roles over one-offs

Assign shared roles instead of configuring each person individually: updating the role updates everyone who holds it.

Separate approval from management

For money-movement and other high-risk features, keep Approve on a dedicated approver role so no single person can both run and release a payout.

Regular audits

  1. Review who holds which roles monthly.
  2. Remove roles when someone’s responsibilities change.
  3. Use audit logs to verify appropriate access.

Troubleshooting

A member can’t access an expected feature

  1. Check their base role.
  2. Check which roles they’re assigned and what those roles grant.
  3. Confirm the feature’s module is enabled (Settings → Modules).
  4. Check whether the feature requires a subscription tier.

Permission changes not taking effect

  1. Ensure the role change was saved.
  2. Ask the member to refresh the page.
  3. Confirm the role is actually assigned to them.

Can’t find role controls

  1. Only Owners and Admins can manage roles.
  2. Navigate to Settings → Organization → Roles & Permissions.

Two ways to read a role

The role editor has two views of the same thing:

  1. Plain-language toggles, grouped by outcome, are the default. Each one says what a person will be able to do, and a live preview spells out the effective permissions in plain English as you change them.
  2. The advanced matrix is the raw feature-by-action grid, available when you need to see exactly which action is granted.

Build a role from a template or clone an existing one from Settings -> Organization -> Roles and Permissions, then open it to edit. New accounts are offered a set of recommended starter roles so nobody has to build the first ones from nothing.

Permissions are resolved on the server

Every request is checked against the resolved permission for that feature and action. The interface never decides access on its own, so a hidden button is not a security control and a visible one you are not entitled to use is still refused.

Menu Visibility is the companion screen for presentation: it hides items for one person or for the whole organization without changing what anyone may do. See Managing Modules.

Approval rights are separate

Who may approve money is not a role setting. It is set at Settings -> Organization -> Approvals, including whether an owner may approve their own request and whether a second approver is required above a threshold. See Approvals and Spending Policies.

Next Steps