Reference

Permissions

Every permission in ROK in plain language — what each one lets someone do, where it shows up in the console, and which built-in groups carry it.

Permissions this page uses

Create content — Start new guides, articles, checklists, quizzes, videos, and audio.
Edit content — Change any draft or item body, assets, cover image, and tags.
Submit for review — Move a draft into the review queue.
Publish — Make content live for operators on mobile.
Second approval — Sign off on procedures flagged as requiring two-person approval.
Unpublish — Withdraw published content from operators.
Delete content — Permanently remove content items.
Manage taxonomy — Edit tags and tenant content templates.
Manage users — Invite, suspend, edit profiles, and assign groups.
Manage groups — Create groups and change what each group can do.
Manage settings — Change site name, tagline, and feature flags.
Manage branding — Change the logo, colors, name, fonts, and appearance for this tenant.
Manage access codes — Create, revoke, and monitor the join codes operators use to sign up.
Manage billing — Change or pause the plan, update the payment method, and view invoices.
Manage badges — Design badges, set how they are earned, and configure recognition settings.
Award badges — Grant a badge by hand, approve nominations, and revoke an award.

Permissions come from the groups you belong to. If you don’t have one, ask someone with Manage groups in your agency.

The Permissions tab is a read-only catalogue of every permission in ROK. Open it from Organization → People & access → Permissions; the tab appears for people with Manage users or Manage groups. Nothing on it changes anyone's access. To give someone a permission, put them in a group that carries it — see Groups and how access works.

How to read the catalogue

The catalogue is split into Content, Taxonomy and Administration. Each entry shows:

the permission's name and its key in code type, such as content.publish. The key is what the Audit log prints when a permission is granted or revoked, so this page is where you translate one into the other;
one line saying what it allows;
Granted by — the built-in groups that carry it in ROK's standard set. This is a fixed reference, not a live read of your agency: your own groups are whatever you have made them. To see exactly what a group grants in your agency, open it.

Content

Permission	Key	Lets someone	Where you notice it
Create content	`content.create`	Start new guides, articles, checklists, quizzes, videos and audio.	New content on All content; importing from the Library also needs Edit content.
Edit content	`content.edit`	Change any item's body, assets, cover image and tags — and create new tags while tagging. Changes to a published item are held from operators until someone with Publish releases them.	Organize, Media, Review due, Field reports, Link check.
Submit for review	`content.submit`	Move a draft into the review queue.	The submit action in the editor and on the content list.
Publish	`content.publish`	Make content live for operators on mobile: publish, schedule a publish, and release changes to published content.	Review queue, Scheduled, Release to operators. Also the only permission that can change whether an item needs a second approval, or change the attachments of a published item.
Second approval	`content.approve`	Sign off on items that require two-person approval.	The approve action on items awaiting sign-off. An approval counts only from someone other than the author and the publisher — see two-person sign-off.
Unpublish	`content.unpublish`	Withdraw published content from operators.	Any move out of Published needs it, including sending a live item back to draft.
Delete content	`content.delete`	Permanently remove content items.	The delete action on the content list and in bulk actions.

The database checks each step of the workflow on its own: holding Edit content does not let someone publish, schedule a publish or change what operators already have, and holding Publish does not let them create. But submitting, publishing and unpublishing are all changes to an item, and only holders of Edit content may change an item — so give Edit content alongside Submit for review, Publish or Unpublish, or those actions will not take effect.

Taxonomy

Permission	Key	Lets someone	Where you notice it
Manage taxonomy	`taxonomy.manage`	Edit tags and the agency's content templates.	Tags (opens the admin console) and Templates (opens the admin console).

Administration

Permission	Key	Lets someone	Where you notice it
Manage users	`users.manage`	Invite, suspend, remove and edit people, reset passwords, and assign groups.	Users, Invites and Audit log here; the member enrolment table and two-factor reset in Settings → Security.
Manage groups	`groups.manage`	Create groups and change what each group can do.	Groups and Audit log here. Also required to put anyone into the Admin group.
Manage settings	`settings.manage`	Change agency-wide settings.	Settings: general (site name and tagline), features, review policy, approval policies, publish checks, security and recognition.
Manage branding	`branding.manage`	Change the logo, colours, name, fonts and appearance for the agency.	Settings → Branding (opens the admin console).
Manage access codes	`access_codes.manage`	Create, revoke and monitor the join codes operators use to sign up.	Access codes.
Manage billing	`billing.manage`	Change or pause the plan, update the payment method, and view invoices.	Billing (opens the admin console).
Manage badges	`badges.manage`	Design badges, set how they are earned, and build badge groups and levels.	Recognition (opens the admin console) — badges, groups and levels.
Award badges	`badges.award`	Grant a badge by hand, and revoke an award.	Recognition → Awards (opens the admin console).

Rules that sit on top of permissions

Permissions count only while someone is an active member. Suspending a person switches off every permission they hold in your agency at once, without touching their groups.
You can only hand out what you hold. Granting a permission to a group, or placing someone in a group, is refused unless you hold the permissions involved yourself.
Two permissions can never disappear. The agency must always keep at least one active member holding Manage users and one holding Manage groups; the database refuses any change that would remove the last of either.
Any permission makes someone staff. A member whose groups grant at least one permission counts as staff — that is who the Staff two-factor policy covers. Members with none are operators, who read published content in the app.

What the built-in groups carry

Group	Permissions
Operator	None.
Author	Create content, Edit content, Submit for review.
Reviewer	Everything Author has, plus Publish, Second approval, Unpublish, Delete content and Manage taxonomy.
Admin	All sixteen.

The catalogue also lists Reviewer under Award badges. Whether your agency's Reviewer group actually carries it depends on when the agency was set up, so open Groups (opens the admin console) → Reviewer to check. Built-in groups cannot be edited; clone one if you need a different mix.