Tutorial · Permissions

Permissions: deny-by-default access control

In Cadenio nobody sees anything until you grant it. Org-wide roles set the baseline, folder and flow rules override it, and per-task rules restrict individual steps.

5 min read · Admins

Permissions

Access is granted, never assumed

Under Settings, the Permissions tab manages access for users and groups. Org-wide roles set the baseline; folder and flow rules override them. Users have no access by default, you add a permission to grant it. Per-task restrictions are configured inside each flow's editor.

The Permissions settings tab explaining deny-by-default access with an Add permission button — Permissions. Deny-by-default: users start with no access, and you grant it explicitly.

How the layers stack

Access resolves from broad to specific; more specific rules win.

Org-wide roles: The baseline for everyone: what a role can do across the whole workspace.
Folder & flow rules: Override the baseline for a specific folder or flow, to widen or narrow access where it matters.
Per-task permissions: The finest grain: restrict who can see or act on an individual task, set inside the flow's editor (People → Permissions).
Deny by default: If nothing grants access, there is none. Safe by design, especially for compliance-sensitive work.

Grant access to groups, not individuals, wherever you can. When someone joins or leaves a team, you change one group membership instead of editing rules across dozens of flows.

Common questions

Why can't a teammate see a flow I can see?

Because access is deny-by-default and no rule grants it to them yet. Add a permission at the org, folder, or flow level, ideally to their group.

Where do I restrict a single task?

Inside the flow's editor: open the task, go to People, then Permissions. Those task-level restrictions are not listed on the org Permissions tab.

Lock down access the right way

See roles, group-based rules, and task-level control on a guided demo.

Watch guided demo Back to tutorials

Access is granted, never assumed

Permissions. Deny-by-default: users start with no access, and you grant it explicitly.

How the layers stack

Access resolves from broad to specific; more specific rules win.

Org-wide roles

The baseline for everyone: what a role can do across the whole workspace.

Folder & flow rules

Override the baseline for a specific folder or flow, to widen or narrow access where it matters.

Per-task permissions

The finest grain: restrict who can see or act on an individual task, set inside the flow's editor (People → Permissions).

Deny by default

If nothing grants access, there is none. Safe by design, especially for compliance-sensitive work.