Custom Roles
PurpletGo uses role-based access control. Every team member has one of five built-in roles - Superadmin, Admin, HR, Manager, or Developer - and each of those maps to a fixed set of permissions. On the Enterprise plan, you can also define custom roles that override individual permissions instead of being stuck with one of the five defaults.
Built-in roles
Superadmin
Has every permission in the system, including the two that Admin doesn't get: managing billing and managing the parent/child organisation hierarchy. There's no separate "bypass approval chain" toggle - Superadmin simply has every permission bit set to true.
Admin
Everything Superadmin has except billing_manage and org_hierarchy_manage. In practice, Admins can run day-to-day operations - offboardings, employees, settings, users, custom roles, audit log - but can't touch the subscription or a multi-org hierarchy.
HR
Built for HR generalists running offboardings day to day. HR can create, view, and edit offboarding records (but not delete them), manage the employee directory, create shipping labels, view checklists, view analytics and the audit log (without exporting either), manage exit interviews, references, and compliance documents, revoke access, and view/manage flight risk alerts. HR cannot manage team members, settings, billing, or integrations.
Manager
Scoped to a narrower slice: view/create/edit offboarding records (not delete), view-only access to employees, assets, checklists, analytics, exit interviews, references, and compliance. Managers can view onboarding records and manage the alumni network, but have no access to audit logs, settings, integrations, or flight risk alerts.
Developer
The most limited role - read-only on offboardings, employees, assets, checklists, and onboarding records. No access to analytics, audit logs, exit interviews, compliance, team management, or flight risk. Developers manage their own API keys separately through Settings, not through this permission set.
Permission reference
Permissions are grouped by area. This is what each built-in role gets by default (✓ = full access):
| Area | Superadmin | Admin | HR | Manager | Developer |
|---|---|---|---|---|---|
| Offboardings (view/create/edit) | ✓ | ✓ | ✓ | ✓ | View only |
| Offboardings (delete) | ✓ | ✓ | - | - | - |
| Employees (manage) | ✓ | ✓ | ✓ | View only | View only |
| Assets (manage) | ✓ | ✓ | View only | View only | View only |
| Checklists (manage templates) | ✓ | ✓ | - | - | - |
| Analytics (view / export) | ✓ / ✓ | ✓ / ✓ | View only | View only | - |
| Audit log (view / export) | ✓ / ✓ | ✓ / ✓ | View only | - | - |
| Exit interviews (manage) | ✓ | ✓ | ✓ | View only | - |
| References & background checks | ✓ | ✓ | ✓ | View only | - |
| Compliance documents | ✓ | ✓ | ✓ | View only | - |
| Access revocation | ✓ | ✓ | ✓ | - | - |
| Integrations | ✓ | ✓ | - | - | - |
| Team & settings management | ✓ | ✓ | - | - | - |
| Billing / org hierarchy | ✓ | - | - | - | - |
| Flight risk alerts | ✓ | ✓ | ✓ | - | - |
| Alumni network | ✓ | ✓ | ✓ | ✓ | - |
This table shows the built-in defaults. A custom role can turn any of these on or off individually, regardless of which base role it started from.
Creating a custom role
Custom roles require the Enterprise plan. On other plans, everyone assigned a role is bound to that role's built-in permission set.
Open Roles & Permissions
Go to Settings → Roles & Permissions. Only Superadmins and Admins can create, edit, or delete custom roles.
Name it and optionally seed from a base role
Give the role a name and description. You can optionally base it on one of the five built-in roles, which copies that role's permission set as a starting point instead of starting from nothing.
Toggle individual permissions
Turn specific permissions on or off. Only permissions PurpletGo recognizes are saved - anything else in the request is silently dropped.
Save
The role appears in the role list immediately and can be assigned to team members. Editing a custom role later takes effect right away for everyone assigned to it - no reassignment needed.
Assigning a custom role to a user
Go to Settings → Team, open a member, and pick a custom role from the dropdown (or "No custom role" to fall back to their built-in role permissions). Assigning an actual custom role requires the Enterprise plan, same as creating one.
Two related settings work on any plan, independent of custom roles: restricting a user to specific departments, and limiting a Manager to see only their direct reports. Both are set from the same member screen.
A custom role can't be deleted while team members are still assigned to it - reassign them first.