Permission scopes
Four scopes — View only, View + send, All, Administrator — a table of who can do what, and how to change a member's scope.
Updated 19.10.2026
Table of contents
Every member of an organisation has one of four scopes. You choose it when inviting and can change it at any time on the Members screen. A scope applies within one organisation — the same person can have a different one elsewhere.
| Scope (as in the app) | In short |
|---|---|
| View only | Reads mail. Doesn't write, mark, move or delete. |
| View + send | Writes and replies, marks, labels, moves, assigns — but doesn't archive or delete. |
| All (including delete) | Full mailbox handling, archive and trash included. |
| Administrator (org management) | Everything above plus organisation settings, members and data. |
The invitation form pre-selects View only — deliberately the safest choice.
Who can do what
| Action | View only | View + send | All | Administrator |
|---|---|---|---|---|
| Read threads, search, download attachments | ✓ | ✓ | ✓ | ✓ |
| New message, reply, forward, drafts, scheduled send | — | ✓ | ✓ | ✓ |
| Star, read/unread, mute, spam | — | ✓ | ✓ | ✓ |
| Attach labels to a thread | — | ✓ | ✓ | ✓ |
| Move a thread to a folder, create and rename folders | — | ✓ | ✓ | ✓ |
| Assign a thread, change status, internal note | — | ✓ | ✓ | ✓ |
| Archive, trash, delete a folder | — | — | ✓ | ✓ |
| Delete someone else's internal note (authors delete their own) | — | — | — | ✓ |
| Mail accounts, sending identities, signatures, migration wizard | — | — | — | ✓ |
| Domains, delivery log, storage and plan meters | — | — | — | ✓ |
| Create and edit labels, spam rules, multi-inboxes | — | — | — | ✓ |
| Routing rules, reply templates, SLA | — | — | — | ✓ |
| Members, invitations, audit log | — | — | — | ✓ |
| ZIP backup, editing and deleting the organisation | — | — | — | ✓ |
Buttons the scope doesn't allow are hidden in the inbox. If someone triggers an action another way (say, from an old link), they get the message "Your permissions in this organisation don't allow this action."
Scope versus mailbox access
The scope says what a person can do. Separately, you set which mailboxes they see: full access, or only the accounts in selected multi-inboxes (the Access column on the members screen). The two work together — for example "View + send" restricted to the "Sales" multi-inbox means writing and replying only in the sales mailboxes. Details: Multi-inboxes.
Admins always have full access — multi-inbox restrictions don't apply to them.
Changing a scope
On the Members screen, pick the new scope from the dropdown in the Role column — the change saves immediately and applies from the person's next click. They don't need to sign out.
Limits:
- you can't change your own scope — another admin has to;
- the last admin can't be moved to a lower scope (the "at least one admin" rule).
Every scope change goes into the audit log as member.scope.change, with the new role and scope.
Scopes govern work in the app. Access through API v1 uses the organisation's tokens, not member scopes — see API.
Did not find the answer?
Check the help section with typical problems or write to us — we reply on working days.