Inklok Docs

Workspace Roles

Understand which workspace roles can create, operate, audit, and administer agreement workflows.

Workspace roles control what authenticated members can do inside an organization. Assign the least privileged role that lets a person do their work. Role checks are enforced by the Inklok API and are separate from signer access links used by external agreement recipients.

Signer is not a workspace invite role

Signers are agreement participants scoped to a specific signing flow. They do not receive workspace membership, organization metadata, API credentials, template access, or member-management access.

Workspace Role Summary

Role	Permitted actions	Not permitted
`workflow-editor`	Create, edit, and publish templates and workflows.	Send agreements, manage executions, decrypt agreements, or manage users.
`workflow-operator`	Everything Workflow Editor can do, plus send workflows, view execution metadata, resend notifications, and cancel executions.	Decrypt or reconstruct agreements, rotate keys, or manage users.
`agreement-auditor`	Everything Workflow Operator can do, plus reconstruct and decrypt organization agreements for audit and review.	Manage users, assign roles, or rotate organization keys.
`organization-admin`	Full workspace administration, including inherited auditor rights, user and role management, API key management, and key rotation.	Cross-organization platform governance unless separately granted platform access.

Inheritance

Workspace permissions are cumulative from Workflow Editor through Organization Admin.

Workflow Editor
  -> Workflow Operator
  -> Agreement Auditor
  -> Organization Admin

Signer Boundary

A signer is not an organization member role for workspace invitations. Signer access is granted through an agreement-specific signing session and applies only to that recipient's assigned agreement steps.

Signers can sign and access their own agreement session.
Signers cannot browse workspace documents, templates, members, or API keys.
Signers cannot manage other signers or organization settings.
Signers do not receive broad workspace audit visibility.

Audit and Decryption

Audit visibility follows resource access. Agreement Auditor and Organization Admin can reconstruct and decrypt organization agreements for authorized audit and review workflows. Lower workspace roles cannot decrypt completed agreements.