# Access and roles

## What it does

Decides who can use Nexus and what each person can do. The same rules apply wherever you ask Nexus and in the workspace app.

- **Roles.** A **viewer** can ask questions and read, but can't run anything that changes work. A **member** works on their organization's clients. An **admin** also manages their own organization's people. A **super-admin** manages everything.
- **Your organization's settings.** Its admin chooses whether new people start as viewers or members.
- **A client's own people.** For each client, the role their people have when they ask Nexus in the client's channels: viewer or member, or the organization's default.
- **The access log.** Every refused request and every access change, with who, where, which client and why.

## Use it

- **"New people from our organization should start as viewers."** Sets your organization's new-member role (organization admin).
- **"The client's people should only read."** Makes a client's own people viewers in its channels.
- **"Show the access log."** The last 30 days, newest first. **"Why was my request refused?"** finds your own refusals.

## Who can change what

- **Super-admin:** anything: roles, organizations, your Nexus team's staff, channels, billing.
- **Organization admin:** their own organization's people (viewer, member or admin), its new-member role, its clients' people role, and its clients' shared Slack channels.
- **The account team:** a client's people role.
- Changes that affect access show what they'll do first and apply once you say yes. Changing someone's role signs them out of the app, so the new access applies at their next sign-in.

## Troubleshooting

- **Nexus says you have read-only access.** You're a viewer. Ask your organization's admin to make you a member.
- **Nexus says a request is for your organization's admin.** Only an admin can do that. Ask them, or ask them to make you an admin.

## Prompts

- "New people from our organization should start as viewers."
- "The client's people should only read."
- "Show the access log."
- "Why was my request refused?"