# Right-sized authority for every person > Substrait keeps four kinds of access apart: data groups for what a person may see and read, capability groups for what they may do on the platform, app roles for what they may do on one tool, and each tool's own sign-in. URL: https://substrait.build/capabilities/roles-and-access/ Last updated: 2026-11-06 Substrait keeps four kinds of access apart, because most access mistakes come from mixing two of them. Groups follow your business domains, a person's access is the sum of their groups, and an admin can preview what a set of groups would grant before anyone gets it. ## Four kinds of access | Kind | What it answers | Who decides | |---|---|---| | Data group | What you may see and read: APIs, tools' APIs, data sets, fields | The group's data owner approves each authorisation | | Capability group | What you may do on the platform: view the security centre, manage people, browse tools, operate agents | An admin composes it from a fixed list | | App role | What you may do on one tool: deploy it, change its settings, manage its sign-in list | The tool's owner assigns it, per person | | The tool's sign-in | Who may open a tool, in each environment | The tool's owner, or someone they delegate | ## Groups by domain, not by level Finance sees finance and operations sees operations. No group sits above another. A person's access is the sum of their groups, and a permission goes only when the last group carrying it is removed. ## App roles Two app roles come built in. A Collaborator can do almost everything the owner can, except manage people and ownership. An Access manager holds only the tool's sign-in list. Admins can narrow any role by configuration. ## Sign-in Every tool signs people in through your identity provider. In production, the owner chooses whether a tool needs sign-in, because a customer-facing form or status page must be public. A person with no company account can be given access to one tool by a sign-in link, and withdrawing it ends their session at once. ## Check before you grant An admin can act as a member, bound by that member's access, and preview what a set of groups would grant before anyone receives it. ## Country tags Every person and tool can carry a country tag, for finding and filtering. A tag grants nothing.
Substrait console: two groups compared permission by permission, showing what each one allows.
Comparing what two groups allow. Product UI. Sample data.
## Related - [Company data, granted by its owner](https://substrait.build/capabilities/governed-data-access/): A tool on Substrait reads company data only after the data owner approves it, for a set time, through one gateway that holds the credential, checks every call and records every read. - [Every tool your people use, in one place](https://substrait.build/capabilities/home-and-explore/): Substrait gives every employee a Home page with their own tools on it, and an Explore directory of what colleagues chose to share. Finding a tool never grants access to it. - [An audit trail nobody can alter](https://substrait.build/capabilities/audit-trail/): Substrait records every access and action in an audit trail that nobody, a platform admin included, can change after the fact. It is queryable, exportable to your security monitoring, and kept in storage you control. - [Security, configured exactly for your organisation](https://substrait.build/security/): Security, Substrait's third pillar. Every release is checked before production, and each organisation sets how strict that check is: its own risk tiers, blocking rules, severity names, approvers and deadlines, with a full audit trail nobody can alter.