--- title: Manage Access Roles slug: manage-access-roles docTags: a6GhndyAjUvfo8HfhhHOq,j7cEyCmCABSdDwyI2-2NX,6q8LfCxpmWGRrmM9WYNkF createdAt: 2025-07-10T11:57:32.687Z --- You can view permission levels for each access role, customize existing access roles, and create your own custom roles within Ashby. Access roles are primarily used to provide job, location, or department-specific access to users with elevated access, or to limit access for organization admins. :::hint{type="warning"} **Prerequisites:** You must have Organization Admin access to edit or create new access roles. ::: Access roles can be viewed on all plans: | Foundations | Legacy Plus | Plus | Enterprise | | ----------- | ----------- | ---- | ---------- | | ✅ | ✅ | ✅ | ✅ | You can create new custom access roles and amend existing access roles on the Legacy Plus, Plus, and Enterprise plans: | Foundations | Legacy Plus | Plus | Enterprise | | ----------- | ----------- | ---- | ---------- | | ❌\* | ✅\* | ✅\* | ✅ | :::hint{type="warning"} \*Customers on the Foundations plan can only edit the External Recruiter access role. Legacy Plus and Plus customers can modify existing roles and create up to three custom access roles. Enterprise customers can modify and create as many custom access roles as needed. ::: # Access roles To view your active access roles and create new ones, navigate to **Admin > Organization Setup > [Access Roles](https://app.ashbyhq.com/admin/permissions/access-roles)**. All existing access roles and their permissions are listed in a grid. You can also use this as a reference when assigning access roles to users with elevated access. ![The access role grid with an additional access role added - all permissions are listed here for easy reference.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/gaQcQwFVZT76nuS6AtMbW_access-roles-ashby-2026-07-14-at-43139-pmgrid.jpg) # Assigning multiple access roles You can assign multiple access roles when a user needs different permissions in different parts of your organization. For example, you can give someone Analyst access across the organization for reporting, then give them Hiring Manager access for a specific team where they need to review applications, schedule interviews, or edit candidates. A team access role and a job-specific role can also work together when the user has a broad responsibility across a team and an additional responsibility for one job. For example, a recruiter can receive Hiring Team Member access for every job on the Marketing team through a team access role, then receive Hiring Manager access for one Marketing job they own. The team role provides baseline access across the team, while the job-specific role supports the additional work on that one job. :::hint{type="info"} Use a job-specific role when a user needs more access or permissions for one job than their broader team or location role provides. You can also use a job-specific role to make access more restrictive for one job when the user has wider permissions through a team or location role. ::: Multiple roles work when each role applies to a distinct job, team, or location. They can also be useful when you want to extend a user’s access for one responsibility without replacing the access they already have elsewhere. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/LJhkX9-fTkojJ-sh3NDxk_employees-ashby-2026-09-22-at-82504-am.jpg" size="80" isUploading="false" width="831" height="497" darkWidth="831" darkHeight="497" alt="Ashby Access Roles settings showing an Analyst role for the Customer Support team across all locations, a Hiring Manager role for the Customer Support Specialist job, and a TA Specialist role for the Product Documentation Specialist job." showCaption="false"} Before assigning another role, check whether both roles apply to the same job or have overlapping job-specific scopes. Assigning two different job-specific roles to the same job can trigger this error: ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/2AkdHD75rjw6Yi1jNiV_i_vp-approver-role-offer-fields-plain-2026-09-21-at-84222-am.jpg" size="60" isUploading="false" width="493" height="83" darkWidth="493" darkHeight="83" alt="Error message stating, “This user already has a role assigned to them with conflicting policies.”" showCaption="false"} Ashby needs one effective permission for each job. When two job-specific roles conflict, Ashby cannot combine them into a single policy. :::hint{type="info"} Department and location access roles generally do not trigger this specific error when they overlap with a job-specific role. Ashby uses the access scope to determine which permissions apply. For overlapping team and location scopes, the more restrictive role generally applies. ::: ## Resolving conflicting policies If you see the conflicting policies error, use one of these approaches: 1. Create one custom access role that contains all of the permissions the user needs, then assign that role to the user. 2. If the permission should apply across a department or location, assign a department or location access role with the needed permission instead of adding another job-specific role. # Creating a new access role To create a new access role: 1. Click `+ Add Access Role`. 2. Give your role a title, then use the checkboxes to determine the access that the role should have. You can pick from the following options: ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/RaYghmjCxm2zGEF96ajiw_create-access-role-stripes.jpg" size="80" isUploading="false" width="880" height="1612" darkWidth="880" darkHeight="1612" alt="The permission stripes when creating an access role" showCaption="false"} :::Paragraph{indent="2"} **Can See Notes:** Can view notes added to a candidate profile (with the exception of private notes). ::: :::Paragraph{indent="2"} **Can Add Notes:** Can add notes to the candidate profile (to enable this option, the Can See Notes option must be enabled). This has been separated out from Can Add/Edit Candidates for additional flexibility. ::: :::Paragraph{indent="1"} **Can See Candidate Profiles:** Can view candidate profiles. ::: :::Paragraph{indent="2"} **Can Add/Edit Candidates:** Can add new candidates in Ashby and edit existing candidate profiles (to enable this option, the Can See Candidate Profiles option must be enabled). ::: :::Paragraph{indent="2"} **Can See Private Fields:** Private notes/fields permissions allow access to private fields, data exports, candidate experience survey submissions and results, offers, and files marked as private. To enable this option, the Can See Candidate Profiles option must be enabled. ::: :::Paragraph{indent="2"} **Can See Email Communication:** Can view emails exchanged with the candidate that have synced back to Ashby. ::: :::Paragraph{indent="1"} **Can See Feedback Forms:** Can view feedback forms that have been added or completed on the candidate profile. ::: :::Paragraph{indent="2"} **Can Submit Feedback on Behalf of Others:** Can complete feedback forms on behalf of other users (to enable this option, the Can See Feedback Forms option must be enabled). ::: :::Paragraph{indent="1"} **Can Email/Schedule Candidate:** Can email or schedule interviews for candidates (to enable this option, the Can See Candidate Profiles option must be enabled). ::: :::Paragraph{indent="2"} **Can Add/Edit Jobs:** Can create or edit jobs. ::: :::Paragraph{indent="2"} **Can See Hired Candidates:** Can view candidates in the Hired stage of the job's pipeline. ::: :::Paragraph{indent="2"} **Can Add/Edit Hired Candidates:** Can add or amend candidates in the Hired stage of the job's pipeline (to enable this option, the Can See Hired Candidates option must be enabled). ::: :::Paragraph{indent="2"} **Can Make One-Off Edits to Approval Process:** Can adjust an approval process on a one-off basis (more on this in [Offer Approvals](docId\:oFX_SMDkYnZv-l6UuJVgH)). ::: :::Paragraph{indent="2"} **Can See Meeting Recordings:** Can view AI Notetaker recordings of interviews for the job. ::: 3. Click `Create`. When assigning permissions and adding access roles to users, your new access role will now show in the **Access Role** dropdown. ![](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/DuOobT1FawnFEEdi0nuIh_access-roles.jpg) # Editing and archiving an access role To amend an existing access role, click on it within the **Active Access Roles** table. ![A custom Recruiting Coordinator access role highlighted on the access role table.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/Iorziu20DeW8feOv2tutK_access-roles-ashby-2026-07-15-at-102058-am.jpg) You can then use the checkboxes beside each permission to amend that role's access. Click `Update` to confirm your changes. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/GWiNzTA2C2Hpl-j7Gdk-2_editing-the-permissions-of-an-access-role.jpg" size="80" isUploading="false" width="1140" height="1626" darkWidth="1140" darkHeight="1626" showCaption="false"} You can click on the **History** tab to view any previous changes made to the access role. The history lists the date and time the change was made, who made the change, and the changes that were made. To archive an active access role, click the `Archive` option in the top-right corner of the Update Access Role pop-up. :::hint{type="info"} Archiving an access role does not impact any users who already have this access role applied to them within their permissions. It only stops the access role from being added to users in the future. ::: # Restoring an access role If you've archived an access role by mistake, use the `Active` dropdown filter to view all access roles or only archived access roles. Then click on the access role you'd like to restore. ![The Active drop-down for access roles.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/76I8EFSQfcf1gXSgFOIA9_access-roles-ashby-2026-07-15-at-102400-am.jpg) On the **Update Access Role** pop-up for the access role, click the `Restore` button in the top-right corner. Once restored, this access role is available when providing access to elevated access users. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/xXbZH1-2JIbTD83SgI2IQ_access-roles-ashby-2026-07-15-at-102310-am.jpg" size="80" isUploading="false" width="1154" height="1628" darkWidth="1154" darkHeight="1628" alt="Restoring a custom access role." showCaption="false"} # FAQ ### Can I add Quality of Hire permissions to custom access roles? Quality of Hire permissions are added separately. You can read more about this access role in [User Permissions](docId\:i5jHibmkQHYobnnvrl8rk). ### Can I make edits to the built-in access roles? Yes. Refer to the **Active Access Roles** table when assigning these permissions in the future, as the defaults listed in [User Permissions](docId\:i5jHibmkQHYobnnvrl8rk) no longer apply if adjustments are made. ### I already have more custom access roles than I'm supposed to have on my plan — will some of my roles be deleted? No. If you already have existing custom access roles in your account, you retain those access roles, even if they are above your plan's thresholds. ### Why can't I assign another job-specific access role? Two job-specific roles assigned to the same job, or to overlapping job-specific scopes, can produce a conflicting policies error. Ashby needs one effective permission policy for that job and cannot combine conflicting job-specific roles. Department and location access roles generally do not trigger this specific error because Ashby uses their access scope to determine which permissions apply.