Who can change which settings?

The gate on Settings itself

You can open Settings if you are one of:

• a company Owner
• a company Admin
• a Velory system admin (superadmin or organisation admin)

Managers and employees cannot, however many permissions their role has. Settings is not in their menu, and if they follow a link to a settings page they get Page not found — "The page you're looking for doesn't exist or has been moved."

That is not a permission message, so it can look like a broken link. If someone reports a settings link that does not work, check their role before anything else.

Two checks, one after the other

Opening a settings page passes two checks:

1. The base role. The person's role must be built on Owner or Admin. This decides whether Settings opens at all.
2. A switch, for some pages. Inside Settings, a few pages also need a particular permission switched on in the role. If it is off, that page is missing from the Settings menu.

The shipped Owner and Admin roles have every switch on, so the second check never stops them. Anyone holding one of them sees every Settings page.

The second check only matters when you create your own Admin-based role and switch something off:

Integrations stays in the menu either way. Without Settings › Company, each integration's own page refuses to open.

Some pages, such as Categories and API Tokens, follow permissions that have no switch in the role editor. Every Admin-based role sees them.

Turning these switches on for a Manager- or Employee-based role does nothing for Settings: the first check has already turned them away.

Scoped admins are the real exception

An admin can be restricted — to one group, when their role was assigned from that group's members table, or to their reporting tree, when their role's reach says so. Restriction limits which records they see, and it also removes company-wide surfaces:

• Organization disappears from their sidebar, and opening it redirects them to General.
• A group-restricted admin cannot assign roles.

A scoped admin is not a lesser admin everywhere. They are a full admin over less data, plus a few structural pages they cannot reach. If an admin is missing a page you can see, check how their role is restricted before checking their permissions.

Changing who can do what

Through roles. Create a custom role, choose its base role, set its permissions, and assign it. There is no per-person exception — when one person needs something different, they get a role of their own. See What do roles and permissions control?.

A role's permissions can go up to the defaults of the base role one level above it. That makes a Manager-based role able to hold every admin permission: it still cannot open Settings, but it can do admin work everywhere else. Check what a Manager-based role holds before handing it out.

Every role change and assignment is recorded on the Activity Log tab of Roles & Permissions, with the actor's name.

Good to know

Why does this admin see fewer pages than me?

In likely order: their role is restricted to a group or their reporting tree; they hold a custom role with permissions removed; or they are a Manager and are not actually an admin.

Can I let a manager change one setting?

Not really. Settings is gated on being an Owner or Admin, so there is no permission you can grant a Manager that opens a settings page. If they need to change something in Settings, they need an Admin-based role — restricted to a group, if you want to limit what they can see.

Who can invite or promote another admin?

Anyone with an Owner- or Admin-based role, up to their own level. An Admin can make more Admins but not an Owner, and nobody can change their own role. Inviting someone with a role follows the same limit.

This cannot be switched off in a custom Admin-based role, so treat every Admin-based role as one that can create more admins.

Does SSO change any of this?

No. SSO decides how someone signs in, not what they can do. Roles still govern access.

One SSO setting does hand out a role: JIT provisioning (just-in-time). With it on, Velory creates a login for an existing employee the first time they sign in through your identity provider, and gives them the Default role for new users you picked. That role cannot be Owner- or Admin-based, or grant more than a Manager has by default, so JIT never creates an admin. See How do I set up single sign-on?.

What is the difference between an Owner and an Admin?

For settings access, nothing you will notice — both reach every page. Owner additionally carries the ability to switch company, which matters in multi-company setups.