Roles & permissions
What each workspace role can do, and how to choose roles for your team.
Every member has one role, set when they're invited and changeable any time from the Role column in Settings → Members. Kepler checks the role on the server for every request, so what a role can't do is refused, not just hidden.
The roles
| Role | Intended for | In short |
|---|---|---|
| Owner | Agency principal | Full workspace administration and recruiting access. Only owners can permanently delete records, request a full workspace export, grant emergency access and manage blocked addresses. Personal communications still follow sharing permissions. |
| Admin | Ops / senior managers | Everything an owner does day-to-day: all records including placement fees, all reports including Placement Finance, workspace settings, and member management. |
| Finance | Finance team | Reads companies, contacts, candidates, jobs and applications; reads and updates placements, including fee figures; reads Reports, including finance reports. No interviews or lists, can't save table views, no exports by default, and no member or workspace administration. |
| Team lead | Desk / pod leads | Full recruiting access across companies, contacts, candidates, jobs, applications, interviews, lists, activities and tasks. Placements are read-only and fee figures are hidden. Reports yes, finance reports no. Can invite teammates but cannot change roles, remove members or revoke invites. Can manage job, pipeline, job board and client portal settings, but not workspace-wide settings such as General, Security & data or AI. |
| Recruiter | Consultants | The 360 desk: full control of companies, contacts, candidates, applications, interviews, lists, activities and tasks, and can create and edit placements (but not delete them). Jobs are read-only and placement fee figures are hidden. In Reports they see only the Consultants dashboard (placements by share, no fees). |
| Coordinator | Delivery support | Schedules and runs interviews, moves applications through stages, and manages activities and tasks. Candidates, contacts, companies, lists and placements are read-only; there is no access to Jobs. In Reports they see only the Consultants dashboard. |
| Sourcer | Research / talent pool | Full control of candidates and lists. Companies, contacts, jobs, applications and interviews are read-only; notes and tasks can be created but not edited or deleted; no placements and no Reports. |
| Viewer | Stakeholders | Read-only everywhere, including Reports (without finance reports). Cannot save or change table views. |
Fees and finance
Placement fee and finance figures, and the Placement Finance dashboard, are available to Owners, Admins and Finance. Recruiting roles do not gain financial access just because they can read a placement: for everyone else fee values are left out of lists and exports, can't be used to filter, sort or group, and are kept out of the record timeline, field history, reports, the assistant, connected AI tools and the API.
What each role can see
- Record types follow the role. A role that can't open a record type doesn't see it anywhere else either: a Coordinator doesn't see jobs, or the notes and updates logged on them, in activity feeds and search; a Sourcer doesn't see placements.
- Private views and lists are private. A saved view or list set to private is visible only to the person who made it. Team lists are visible to everyone who can read the records in them, but only the list's owner can rename it, delete it or change who's in it.
- Company records are shared within the workspace with every role that can read companies. Contact us about security controls at support@keplercrm.com.
Exports and connected tools
Owners and Admins can export by default. Other roles, including Finance and Recruiter, need the Data export switch turned on for them in Settings → Members (with a daily row allowance), or the workspace-wide Everyone can export switch in Settings → Security & data. Exporting also requires permission to read the records.
Exports are logged and admins are alerted. Export activity in Settings → Security & data (View log) records who exported, when, what and how many rows, without recording the exported contents, and any export above the Large-export alert size triggers an alert to administrators.
Removing a member
Owners and admins remove a member with Remove from workspace… in the row's menu in Settings → Members. The dialog shows what they own and asks what happens to it:
- Hand their work over to a teammate — open tasks, records and pending reviews move to that person, or
- tick Keep their records under their name — their records stay with them, marked as left, and only open tasks and reviews move. Their placement credit stays with them.
Either way, completed tasks, notes, emails and activity history keep their name, and if they connected their own accounts you choose whether to keep or delete the emails, messages and calls they synced. People who left are listed under Former members on the same page (owners and admins), with what's still under their name; Move records… hands those records to an active member later. A former member can't sign in to the workspace and doesn't use a seat.
Removal blocks the member's workspace access at once and revokes their personal MCP connections and access grants. Workspace API keys are independent credentials and remain active until an administrator revokes them in Settings → Developers. Revoke any key the departing member knows; removing their membership alone does not invalidate it.
Rules worth knowing
- Managing the team: only owners and admins can change roles, remove members and revoke invitations.
- Inviting: owners, admins and team leads can invite. A team lead can only invite Recruiter, Coordinator, Sourcer and Viewer; an owner or admin can invite any role at or below their own. The invite dialog never offers Owner — a second owner is appointed by an existing Owner changing an existing member's role.
- Invitations expire after 14 days and hold a seat until they're accepted, revoked or expired. See Billing & seats.
- Self-protection: you can't change your own role, you can't assign a role above your own or manage someone ranked above you, and the workspace always keeps at least one owner or admin.
- Email visibility is orthogonal to roles — even an owner can't read a teammate's restricted mailbox beyond its sharing level. See Email privacy & sharing.
Choosing roles
Default consultants to Recruiter — but if they need the full Reports, or to create and edit jobs themselves, they need Team lead or higher. Reserve Owner/Admin for people who should see fee figures and change workspace settings. Use Viewer for anyone who needs to see, not touch.