Access Management

Control who can access, edit, and administer each smarttable.

Opening Access Management

Go to More → Access on the entries page toolbar.

Two Independent Access Layers

Access is checked at two genuinely separate levels, and it's worth understanding the difference before configuring either:

Layer	Governs	Scope
Org-wide Role	Whether admin menus/pages are reachable at all (System Admin, SmartTable Admin, User, Viewer, Vendor)	One per user, applies everywhere in that organization
Per-SmartTable access grant	What a specific user can actually do on this one smarttable — this is the layer this page's Share/Revoke/Promote/Demote actions manage	Independent per smarttable — a user can be an Admin on one and have no access at all to another

A user's org-wide Role and their per-smarttable grant are checked independently — being a SmartTable Admin on one table says nothing about another table unless they're separately granted access there too. This is also why revoking someone's access to one smarttable never touches their access to any other.

Manage SmartTable Access Modal

The modal shows:

SmartTable creation info (who created it and when)
Approval info (if the smarttable has been approved)
List of users with current access and their roles
A multi-select to share access with new users

Actions

Action	Description	Who Can Do It
Share Access	Grant smarttable access to one or more users	SmartTable Admin, System Admin
Revoke	Remove a user's access to the smarttable	SmartTable Admin, System Admin
Promote	Promote a regular user to SmartTable Admin for this smarttable	System Admin, User Management users
Demote	Demote a SmartTable Admin back to regular user	System Admin, User Management users

⚠️ Protected Users Users with user management access or the system admin account cannot be demoted or have their access revoked. These buttons will be disabled for such users.

Role Differences

Capability	Viewer	Regular User	SmartTable Admin	System Admin
View entries and displays	✓	✓	✓	✓
Create entries	—	✓	✓	✓
Edit own entries	—	✓	✓	✓
Edit submitted entries	—	—	✓	✓
Delete entries	—	—	✓	✓
Unsubmit entries	—	—	✓	✓
Release locks	—	—	✓	✓
SmartTable Settings	—	—	✓	✓
Manage Access	—	—	✓	✓
Refresh SmartTable	—	—	✓	✓
Backup Attachments	—	—	✓	✓
Autofill Configuration	—	—	—	✓
Notification Buttons Config	—	—	—	✓

A Viewer is read-only: they can open the SmartTable and its entries but can't create or edit anything. The four roles above are fixed; there's no screen for creating custom roles.

Entry-Level Access Control

Beyond smarttable-wide access, individual entries (or projects, in apps built on the DMS layer) can have their own finer-grained permissions. This must first be turned on for the smarttable in SmartTable Settings.

ℹ️ Enabling It In SmartTable Settings → Access & Permissions, toggle Enable entry-level access control. Once on, an Access button appears on individual entries for authorized users.

Rule-Based Editor

The editor is split into three labelled groups, each holding a different kind of rule. Every rule carries its own level — View, Edit or Admin — picked from the dropdown on its row.

Group	Rule	Description
Automatic access	The person who created the entry	Resolved per entry — whoever added it gets this level on it
Automatic access	Anyone sharing an attribute with the creator	Pick a user attribute (e.g. Department); everyone holding the creator's own value for it qualifies, so a team sees its own entries
People	Named users	Explicitly pick users. Each person appears once, at their single highest level
Attribute rules	Attribute value	Any user whose attribute matches one of the values you choose qualifies, regardless of who created the entry

💡 "What do these mean?" The button in the editor's header opens a capability matrix — one row per thing a person can do, one column per level, ticked or crossed — so you can see exactly what View, Edit and Admin each allow on this screen before assigning one.

ℹ️ How multiple rules combine When several rule types are configured for the same action, a user needs to match any one of them, not all of them — rules are additive (OR'd together), not a checklist someone has to satisfy every item of. Adding a second rule can only broaden who qualifies, never narrow it.

💡 Admin ⊇ Edit ⊇ View The three actions form a strict hierarchy, not three independent switches: granting Admin automatically grants Edit and View too, and granting Edit automatically grants View. You only need to configure the highest level a given user/group should have — there's no need to separately add someone to the View rule if they already qualify for Edit or Admin.

Simple Per-User Editor

Some screens use a simpler picker instead: one row per user, with a single highest role selected — Admin includes Edit and View rights, Edit includes View. System admins and users who inherit admin rights another way always show as locked rows and can't be downgraded from this screen.

⚠️ This Is Additive Entry-level access control narrows or extends who can act on a specific entry — it doesn't replace smarttable-level access. A user still needs some smarttable of access to the smarttable itself before entry-level rules apply.