Roles & Permissions

​

Overview

BRM controls access with roles. A role is a named set of permissions, and each permission unlocks one specific capability, such as browsing agreements, viewing individual transactions, or approving finance workflow steps. Every user holds one or more roles, and their access is the combination of the permissions in all of them. You manage roles from the Roles page in Settings. It lists every role in your organization, and opening a role shows exactly which permissions it includes and who holds it, so you can adjust it to match the way your team works.

​

Organization roles and Relationship roles

BRM has two kinds of roles. Organization roles apply everywhere in BRM, while Relationship roles apply to one specific software or vendor. A Relationship role adds access to one software or vendor on top of whatever a person’s organization roles already allow, and it never removes or downgrades an Organization role. Some permissions behave differently depending on which kind of role holds them. For example, “View credit cards” on an organization role shows every card, while the same permission on a relationship role shows only the cards for that software or vendor.

​

Where permissions apply

Permissions apply everywhere a person can reach data: the BRM app, list exports, Ask BRM (including Slack, MCP, and scheduled jobs), notifications, and the API. Exporting follows viewing, so anyone who can browse a list can also export it; there is no separate export permission. Ask BRM only answers with data the person asking is allowed to see. When you change a role or who holds it, the update reaches people who are already signed in within about two minutes. Nobody needs to sign out and back in.

​

System organization roles

BRM includes the following Organization roles, each marked as System roles on the Roles page.

Role	What it does
Super Admin	Full access to all data and settings, including BRM internal administration.
Admin	Manages users, roles, integrations, workflows, and organization settings.
Member	The configurable minimum permissions granted to everyone in the organization.
Compliance	Reads and edits compliance data.
Compliance Approver	Reads and edits compliance data and approves compliance workflow steps.
Finance	Reads transaction and spend data and edits finance data.
Finance Approver	Reads transaction and spend data, edits finance data, and approves finance workflow steps.
IT	Reads and edits IT data.
IT Approver	Reads and edits IT data and approves IT workflow steps.
Legal	Reads and edits legal agreements.
Legal Approver	Reads and edits legal agreements and approves legal workflow steps.

More information worth knowing to better understand each role:

​

Super Admin

Super Admin is marked Restricted and is locked on the roles page, so its permissions cannot be changed. Only Super Admins can give the role to someone else or edit and remove users who hold it.

​

Admin

Admin does not automatically include sensitive data. To see financial, legal, compliance, or IT information, an Admin also needs the matching data role.

​

Member

Member is the baseline every user receives. Members can create requests and view vendors and software, while financial and legal data stays hidden unless they own a specific software or vendor or someone shares it with them. Because Member applies to everyone, any change you make to it changes the starting point for your whole organization.

​

Data and Approver roles

The Compliance, Finance, IT, and Legal roles are added on top of a person’s other roles to give them access to sensitive information in that area. Each area’s Approver role covers the same data and adds the ability to approve that area’s workflow steps. You choose who approves each step in the request’s configuration; the Approver role is what allows that person to act on it.

​

Relationship roles

Relationship roles are limited to a person’s access to a single software or vendor. BRM includes the following Relationship roles, each marked as Relationship roles on the Roles page.

Role	What it does	Shareable
Compliance Collaborator	Grants compliance access to a specific software or vendor.	Yes
Finance Collaborator	Grants finance access to a specific software or vendor.	Yes
IT Collaborator	Grants IT access to a specific software or vendor.	Yes
Legal Collaborator	Grants legal access to a specific software or vendor.	Yes
Owner	Granted automatically to the owner of a software or vendor.	No

The four Collaborator roles should be assigned when sharing a Software or Vendor page. For example, if a colleague only needs IT details for one vendor, share the IT access on that vendor, and they will receive the IT Collaborator role on that relationship and nowhere else. Software and Vendor Sharing walks through the steps. The Owner role is only granted when the user is assigned as the owner of a software or vendor. Thus, the owner role cannot be shared on its own.

​

Edit a role

Admins can edit roles by default. You can change any system role except Super Admin, along with the relationship roles.

​

Rules for editing roles

• You can only grant what you hold. A role you edit can only include permissions you have yourself, so any permission outside your own access appears greyed out.
• Prerequisites are handled for you. Some permissions depend on others; the finance, legal, compliance, and IT approval permissions, for example, also require the ability to “Approve workflow steps they are assigned to”. Selecting a permission adds anything it depends on, and clearing a prerequisite clears the permissions that rely on it.
• A few permissions are reserved for Super Admins. Granting the Super Admin role, editing or removing users who hold it, and viewing BRM-internal integration details can’t be added to any other role. As a result, the Super Admin view shows more permissions than the editor lists.
• Assign unrestricted roles includes assigning roles to yourself. Anyone with this permission can give any role not marked Restricted to any user, including themselves. They still can’t add permissions they don’t hold to a role.

​

A note on report permissions

​

Custom organization roles

Custom organization roles let you build a role around a specific team or function and choose every permission it includes. A Renewal Lead might read spend and edit agreements without touching anyone’s access, and a Finance Analyst might build reports across spend with no way to change an agreement. Custom organization roles are available as an upgrade. To turn them on, click Request custom roles on the Roles page. Once they are enabled, you build a custom role the same way you edit a system role—by choosing its permissions, adding members, and saving.

​

Permission reference

These tables list every permission you can add to a role, grouped and ordered the way they appear in the role editor.

​

FAQs

• What’s the difference between an Organization role and a Relationship role?
  An Organization role applies everywhere in BRM. A Relationship role applies to one specific software or vendor, such as IT Collaborator or an Owner for a single vendor.
• Can I change what a system role can do?
  Yes. Open the role on the Roles page, adjust its permissions, and save. Super Admin is the only role you can’t edit.
• How do I get custom organization roles?
  Custom organization roles are available as an upgrade. Click Request custom roles on the Roles page to get started.
• Does sharing a Software or Vendor page override someone’s organization role?
  No. Sharing adds a relationship role on that one page and never removes or downgrades an organization role. To change someone’s organization-wide access, update their roles on the Roles page or in Settings > Users.
• Is there a separate permission for exporting data?
  No. Anyone who can browse a list can export it.
• Why are some permissions greyed out when I edit a role?
  You can only add permissions you hold yourself, so anything outside your own access is unavailable.
• How long does a permission change take to apply?
  About two minutes for people who are already signed in.