Roles and permissions

VisionAtlas supports legacy role labels and permission-based access (RBAC v2) for fine-grained control.

Legacy roles

Common role labels include:

• Company Administrator — full tenant setup
• Executive — strategic oversight and approvals
• Manager / Department Leader — department KPIs and initiatives
• Contributor — view performance data and submit updates

RBAC v2

When RBAC v2 is enabled, permissions such as CanViewGoals, CanCreateKPIs, CanViewActionItems, CanCreateActionItems, or CanManageUsers are assigned through roles your admin configures. Users can hold one or more roles.

System role templates (Administrator, Executive, Leader, Manager, Contributor) provide sensible defaults. Admins can create custom roles.

Visibility profiles

Company administrators choose a transparency profile (Open, Balanced, or Restricted) that sets default visibility for goals, KPIs, initiatives, observations, and risks. Individual records can override defaults when allowed.

Restricting sensitive goals, KPIs, and initiatives

When RBAC v2 is enabled (Admin → Security), you can set visibility on individual goals, KPIs, and initiatives:

• Use company default — inherits the transparency profile for that entity type.
• Executive only — visible to users with executive dashboard access (leadership and admins). Use for workforce planning, restructures, or other confidential strategy work.
• Owner and contributors — visible to the record owner plus named employees you select. Use for a small working group (for example HR, Finance, and the executive sponsor).
• Department — visible to employees in the owning department only.
• Public — visible to anyone with base view permission.

For sensitive programs (for example a headcount reduction), create a linked goal, KPI, and initiative with the same visibility mode, use neutral titles until you are ready to communicate, and avoid linking weekly updates until the plan is public.

Apply the same visibility to every record in the bundle so linked items do not leak through the performance graph.

Who configures this

Company administrators configure security and roles under Settings and Admin → Security / Roles after sign-in. This help article describes concepts only — your tenant’s exact permissions are set by your admin.

Action items

Users need explicit permissions to work with action items:

• CanViewActionItems — see the action items list and detail pages
• CanCreateActionItems — create new action items
• CanEditActionItems — update status, owner, due date, and links
• CanDeleteActionItems — remove action items

Managers and executives typically receive create/edit permissions; contributors often receive view and edit on assigned items only, depending on role design.

Executive dashboard, AI Summary, and Reviews

These features share CanViewExecutiveDashboard:

• [Dashboard](/help/dashboard) — operational health
• [AI Summary](/help/ai-summary) — on-demand narrative (/ai-summary)
• [Executive reviews](/help/executive-reviews) — period snapshots (/reviews)

Users without this permission are redirected away from those routes. See Executive leadership overview.

Executive Briefings

Executive Briefings use dedicated permissions (Intelligence+ with AI):

The default Executive role template includes view, generate, edit, publish, export, and share. Company administrators add CanConfigureBriefingTemplates when they should manage the weekly schedule.

Learn more by role

• A day in the life — narrative walkthroughs by role
• Contributor day in the life
• Manager day in the life
• Department leader day in the life
• Executive day in the life
• Admin day in the life
• Contributor guide
• Manager and department leader guide
• Company admin setup
• Executive Briefings
• AI Summary and Executive reviews
• Understanding entities