Roles & permissions

Activator 3 uses a single, unified Designer interface. What you can see and do depends on your role. Roles are implemented via feature flags, and can be customized per tenant.

If your tenant differs from the defaults described below, your UI may expose more or fewer capabilities.

How the permission model works

Activator 3 evaluates access in two steps:

1. Role-based capabilities (feature flags): control which tools, panels, buttons, and workflows are available in the UI.

2. Resource-level permissions: some objects also enforce rules such as membership, ownership, or tenant policy when you perform an action.

How to interpret issues:

• If a feature is missing or disabled in the UI, it is typically blocked by role-based capabilities (feature flags).

• If the UI shows the action but the system blocks the operation, it is typically due to resource-level permissions.

Status legend

The tables below use these status indicators:

• ENABLED — the capability is available by default.

• RESTRICTED — the capability is available but subject to additional resource-level rules (membership, ownership, or tenant policy). See "Design System permissions" below.

• DISABLED — the capability is not available for this role.

Roles at a glance

Default role setup (feature flags)

The table below summarizes the default capabilities configured for each role. Tenants can override these flags.

What the main differences mean in practice

Content Editor vs Content Designer

• Content Editor has key advanced authoring tools disabled by default (Styles Panel, Components Panel, Source Code editing, and Layout workflows).

• Content Designer has Briefcase functionality enabled and keeps the broader authoring workflows available.

Brand Designer

• Brand Designer includes everything in Content Designer, plus governance-related capabilities (primarily around Design Systems).

Document Preview: Viewer Mode

When a user does not have edit permissions for a document, Activator automatically opens it in Viewer Mode — a read-only experience that allows the content to be reviewed without any risk of unintended changes.

How it works:

• Users without edit permissions are automatically redirected to Viewer Mode when they open a document.

• Dashboard document cards display a read-only indicator before the document is opened, so users know in advance that they will not be able to edit.

• Viewer Mode provides a consistent, safe experience for reviewing content — no editing tools are shown.

Who is affected:

Viewer Mode is triggered by resource-level permissions, not role defaults. A user with the Content Designer role can still be placed in Viewer Mode if they are not listed as an editor on a specific document or Design System resource.

No configuration required: Viewer Mode is enabled automatically (AUTO-ON) and requires no tenant configuration.

Design Systems

Design System access is a combination of (A) Design System feature flags and (B) Design System-specific resource permissions. This section documents both.

Design System capabilities (feature flags)

These capabilities control what Design System features are available in the UI. They are role-based and can be customized per tenant.

Design System permissions

In addition to role capabilities, Design Systems may enforce object-level rules when you perform actions. Common patterns include:

• * Membership / editors list: you may need to be added as an editor on a specific Design System (or its resources) to create or update it.

• ** Ownership rules: some Design System resources can be edited or deleted only by their creator unless elevated permissions apply.

If your tenant differs from the defaults described above, your UI may expose more or fewer capabilities.