Roles and what each one can do
The permissions behind Translator, Reviewer, Developer and Admin, and what the Owners of the account hold on top.
Every member of a workspace holds one role. A role is a set of permissions, not a rank on a ladder: Reviewer and Developer each add something different to what a Translator can do, and Admin holds both sets. The Owners of the account that holds the workspace are not given a role at all: they hold every permission through the account.
Admins and account Owners see the same table in the app, under What each role can do on the People and Roles settings pages. It is built from the same rules the app enforces, and your workspace's custom roles appear in it as extra columns.
The built-in roles
| Role | What it is for |
|---|---|
| Translator | Writes translations. Cannot approve their own work. |
| Reviewer | Writes and approves translations, and reviews assigned work. Cannot add keys or run AI translation. |
| Developer | Ships the integration: keys, languages, glossary and AI translation. |
| Admin | Runs the workspace: members, projects, access and approvals. |
| Account owner | Pays for this workspace through its account, and holds every permission in it. |
Permissions by role
Row labels match the app.
| Permission | Translator | Reviewer | Developer | Admin | Account owner |
|---|---|---|---|---|---|
| View the workspace | Yes | Yes | Yes | Yes | Yes |
| View projects, keys and translations | Yes | Yes | Yes | Yes | Yes |
| Edit translations | Yes | Yes | Yes | Yes | Yes |
| Edit translations in scoped locales | Yes | Yes | Yes | Yes | Yes |
| Approve (sign off) translations | No | Yes | No | Yes | Yes |
| Approve translations in scoped locales | No | Yes | No | Yes | Yes |
| View assignment work orders | No | Yes | No | Yes | Yes |
| Review (approve or request changes on) assignments | No | Yes | No | Yes | Yes |
| Add and remove languages | No | No | Yes | Yes | Yes |
| Add and edit keys | No | No | Yes | Yes | Yes |
| Run AI translation, QA and self-heal | No | No | Yes | Yes | Yes |
| Manage in-context screenshots | No | No | Yes | Yes | Yes |
| Manage glossary terms | No | No | Yes | Yes | Yes |
| Create projects | No | No | No | Yes | Yes |
| Edit project settings | No | No | No | Yes | Yes |
| Delete a project | No | No | No | Yes | Yes |
| Grant per-project access | No | No | No | Yes | Yes |
| Assign translators | No | No | No | Yes | Yes |
| Create and revoke API tokens | No | No | No | Yes | Yes |
| Manage publishable keys | No | No | No | Yes | Yes |
| Manage webhooks | No | No | No | Yes | Yes |
| Manage the CMS connection | No | No | No | Yes | Yes |
| Manage CDN delivery keys | No | No | No | Yes | Yes |
| Invite, re-role and remove members | No | No | No | Yes | Yes |
| Read the audit log | No | No | No | Yes | Yes |
| Manage integrations | No | No | No | Yes | Yes |
| Rename the workspace | No | No | No | Yes | Yes |
| Delete the workspace | No | No | No | No | Yes |
| Configure single sign-on and SCIM | No | No | No | No | Yes |
| Require two-factor for everyone in the workspace | No | No | No | No | Yes |
| Manage white-label branding | No | No | No | No | Yes |
| See this workspace's AI words | Yes | Yes | Yes | Yes | Yes |
A few rows need a note:
- The rows marked "in scoped locales" can be narrowed to specific languages on a per-project grant. See Grant access to one project.
- The last four permission rows read "Account owners only. No workspace role can hold it." in the app. No built-in or custom role can carry them.
- See this workspace's AI words is held by every member except one limited to some projects.
- Read the audit log is a permission on every plan, but the log itself can be read on the Enterprise plan only. See The audit log.
- Submitting an assignment for review is not a role permission. The translator an assignment is given to submits it.
Edit versus approve
The split worth understanding is between writing a translation and signing it off. A Translator or a Developer can edit a value but cannot approve it; the Reviewer is the role made for the second person. If you also turn on Require a second reviewer on the People page, nobody signs off a translation they wrote themselves, in any project, account Owners and admins included.
Billing is not a workspace role
No workspace role, Admin included, can see or change the plan, the card or the invoices. Those belong to the account, and its Owners and Billing members manage them. See Account Owners and Billing members.
Custom roles and project grants
- A custom role holds exactly the permissions ticked for it, and sits in the table beside the built-in role whose level it was given. See Create a custom role.
- A per-project grant gives a member a different role on one project, and can narrow them to specific languages. Admins and account Owners always have full access and cannot be narrowed this way.