Permissions
Access is granted, never assumed
Under Settings, the Permissions tab manages access for users and groups. Org-wide roles set the baseline; folder and flow rules override them. Users have no access by default, you add a permission to grant it. Per-task restrictions are configured inside each flow's editor.
How the layers stack
Access resolves from broad to specific; more specific rules win.
- Org-wide roles
- The baseline for everyone: what a role can do across the whole workspace.
- Folder & flow rules
- Override the baseline for a specific folder or flow, to widen or narrow access where it matters.
- Per-task permissions
- The finest grain: restrict who can see or act on an individual task, set inside the flow's editor (People → Permissions).
- Deny by default
- If nothing grants access, there is none. Safe by design, especially for compliance-sensitive work.
Grant access to groups, not individuals, wherever you can. When someone joins or leaves a team, you change one group membership instead of editing rules across dozens of flows.
Common questions
Why can't a teammate see a flow I can see?
Because access is deny-by-default and no rule grants it to them yet. Add a permission at the org, folder, or flow level, ideally to their group.
Where do I restrict a single task?
Inside the flow's editor: open the task, go to People, then Permissions. Those task-level restrictions are not listed on the org Permissions tab.