Custom Roles

PurpletGo uses role-based access control. Every team member has one of five built-in roles - Superadmin, Admin, HR, Manager, or Developer - and each of those maps to a fixed set of permissions. On the Enterprise plan, you can also define custom roles that override individual permissions instead of being stuck with one of the five defaults.

Built-in roles

Superadmin

Has every permission in the system, including the three that Admin doesn't get: managing billing, managing the parent/child organisation hierarchy, and connecting/managing integrations. There's no separate "bypass approval chain" toggle - Superadmin simply has every permission bit set to true.

Admin

Everything Superadmin has except billing_manage, org_hierarchy_manage, and integrations_manage. In practice, Admins can run day-to-day operations - offboardings, employees, settings, users, custom roles, audit log - but can't touch the subscription, a multi-org hierarchy, or connect/manage integrations.

HR

Built for HR generalists running offboardings day to day. HR can create, view, and edit offboarding records (but not delete them), manage the employee directory, record equipment returns and their tracking numbers, view checklists, view and export analytics, view the audit log (without exporting it), manage exit interviews, references, and compliance documents, revoke access, and view/manage flight risk alerts. HR cannot manage team members, settings, billing, or integrations.

Manager

Scoped to a narrower slice: view/create/edit offboarding records (not delete), view-only access to employees, assets, checklists, analytics, exit interviews, references, and compliance. Managers can view onboarding records and manage the alumni network, but have no access to audit logs, settings, integrations, or flight risk alerts.

Developer

The most limited role - read-only on offboardings, employees, assets, checklists, and onboarding records. No access to analytics, audit logs, exit interviews, compliance, team management, or flight risk. API keys are managed by Superadmins only.

Permission reference

Permissions are grouped by area. This is what each built-in role gets by default (✓ = full access):

Creating a custom role

Roles created before September 2026

Older custom roles only stored the permissions that were changed; every other permission came from each member's built-in role. Those roles keep working exactly as before. The role list shows how many permissions are inherited this way, and the editor marks each one Inherited from base role. They stay inherited until you switch them on or off.

Superadmins always have every permission; a custom role never limits a Superadmin.

Assigning a custom role to a user

Go to Settings → Users, click the shield button next to a member, and pick a custom role from the dropdown (or "No custom role" to fall back to their built-in role permissions). Assigning an actual custom role requires the Enterprise plan, same as creating one.

You need Manage team & roles to do this, and:

• you can't change your own custom role or scope
• only a Superadmin can change a Superadmin, and you can't change members whose built-in role ranks above yours
• you can't assign a role that would give the member a permission you don't have yourself

Two related settings work on any plan, independent of custom roles: restricting a user to specific departments (picked from your Departments list), and limiting them to the offboardings they started and the ones they manage (direct reports only: a case counts as theirs when they started it or when its manager email is their own account email, whoever started it, including HR, an HRIS sync or SCIM). Both are set from the same dialog. They don't apply to Admins and Superadmins, who always see everything, so they aren't offered for them.

A custom role can't be deleted while team members are still assigned to it - reassign them first.

Related pages

• Settings
• Flight Risk