> ## Documentation Index
> Fetch the complete documentation index at: https://docs.custral.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Global Permissions

> Workspace-wide access grants that cascade to everything in the workspace.

A **global permission** is an access grant placed directly on the **Workspace** (organization) entity itself, the top of the permission hierarchy. Because every object, page, view, and record sits beneath the workspace, a grant here cascades to all of them unless a more specific grant overrides it. This is how you give someone workspace-wide reach without granting each entity one by one.

Manage them from the **Workspace** panel at the top of **Settings → Permissions**.

## How it works

Permissions in Custral are **access grants** on entities, not a separate list of named capabilities. Each grant pairs a subject with a level:

* **Subject**: a user or a group.
* **Level**: an [access level](/team/permissions/access): Read, Comment, Edit, Delete, Admin, or Owner (each level includes everything below it).

A grant on the Workspace entity is "global" because it flows down the inheritance chain to every sub-entity. Granting a group **Admin** on the workspace makes that group an admin of everything in it; granting **Read** makes the workspace broadly readable.

<Note>
  When the Workspace panel shows "No global grants. All users inherit access from their role," it means nobody has an explicit workspace-level grant and access is coming entirely from each user's role and from grants on individual entities.
</Note>

## Granting workspace-wide access

<Steps>
  <Step title="Open the Workspace panel">
    Go to **Settings → Permissions**. The **Workspace** panel sits at the top, above the Sections & Pages and Objects tabs.
  </Step>

  <Step title="Edit the workspace grants">
    Click **Edit** to open the access modal for the workspace entity.
  </Step>

  <Step title="Add a subject and level">
    Add a user or group and pick an access level (e.g. **Admin** for workspace administrators). Save.
  </Step>
</Steps>

The grant takes effect immediately and cascades to every object, page, and record unless a narrower grant overrides it lower down.

## Relationship to roles and entity grants

* **Roles** set each user's baseline.
* **Entity grants** (on a specific object, page, or record) layer on top. See [Permissions overview](/team/permissions/overview).
* **Global (workspace) grants** are entity grants on the workspace itself, so they're the broadest layer.

## Troubleshooting

| Symptom                                  | Likely cause                                                                     | What to check                                                                                                    |
| ---------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| A user can't administer the workspace    | No workspace-level **Admin** or **Owner** grant, and their role doesn't grant it | Add them (or their group) at **Admin** on the Workspace panel                                                    |
| Someone can see more than expected       | A broad workspace grant is cascading down                                        | Review the Workspace panel; lower the level, remove the grant, or add a narrower override on the specific entity |
| "No global grants" but admins still work | Access is coming from roles, not explicit grants                                 | Expected. Global grants are additive on top of roles                                                             |

## See also

* [Permissions overview](/team/permissions/overview)
* [Access Levels](/team/permissions/access)


## Related topics

- [Team & Permissions](/team/overview.md)
- [Permissions Overview](/team/permissions/overview.md)
- [Teams](/team/users/groups.md)
- [Permissions](/ai/permissions.md)
- [AI Agent Widget](/blocks/widgets/agent.md)