Skip to content
User Manual · Chapter 16 — Administering your company

Why nobody can grant a permission they do not hold

Open any role to edit it, and the permission list you are offered is your own: every permission you hold, and none you do not. Anything else is stripped away even if it is somehow submitted — the rule is enforced by the application, not by politeness.

The reason is escalation. If a manager could tick a permission they lack, authority would quietly grow itself — one generous edit, and the separation of duties in 1.5 becomes decoration. Under this rule, the only way a company's permissions grow is from above: from someone who already holds them. Inside a company that chain tops out at the company administrator, whose role carries the company's full set. Nobody's access can exceed their grantor's — anywhere, ever. It is the single most important sentence in this chapter.

Snapshot: portal-v0-2026-11-10