User Roles and Permissions – Flywheel.io

Flywheel roles and permissions give you granular control over what data users have permission to view and edit.

This article includes:

An overview of the roles and permissions structure in Flywheel
Steps for editing a user's Site, Group, or Project role
An overview of the differences between roles as well a comparison of what actions a user can take with each role

See our other article to learn how to create your own custom role.

Overview

Flywheel users can see, edit, or delete data based on their roles and permissions.

Permission: Enables or disables the ability to perform a specific action in Flywheel. For example, adding notes to a Project is a specific permission.
Role: A group of permissions that are assigned to a user. For some roles you can edit the permissions.

The 3 levels of the hierarchy in Flywheel where you can assign a role are at the Site, Group, and Project level. All users have a role assigned at each of these levels:

Site role: These roles are broad and assigned when you create a new user. In general, these roles match what the user is doing in Flywheel at a high level. Site roles are Site Admin, Developer, and User. Pair these basic site roles with the more granular roles assigned at the Group and Project level.
Group role: Group roles give users broad permissions for what they can do within a Group. For example, do you want users to be able to add other users to the Group? Should the user be limited to just viewing information about the Group? Group roles are Admin, read-write, and read. Assigning a Group role does not automatically add users to Projects in that Group.
Project role: By default, Projects have Admin, read-write, and read-only permissions.
However, Site Admins can create customized project roles for each project. Custom project roles give you the flexibility to only give users access to the data they need. included with the default Project role. See our other article to learn how to create custom roles.

If you only want a user to see certain projects under a Group, you can assign the user a role in the Project without giving the user a Group role. To give the user access to a Project, but not the Group associated with the Project, add them from the Permissions screen of the Project.

Edit site roles

You must be a Site Admin to assign site roles to users. You assign the site role when you create a user in Flywheel, but you can edit site roles. To edit:

Go to Users > choose a user.
Select the Information tab.
Next to Role, select a role from the dropdown.

Site Admin

The Site Admin has the highest site-level permissions. Site Admins can create new Users and Groups, and modify user roles and permissions site-wide. You can think of this as a superuser role.

Developer

Developers have site-wide permission to upload gears. Admins must assign Developers permissions to Groups and Projects to be able to see data.

User

The User role does not carry any special permissions. Admins must assign Users permissions to specific Groups and Projects to be able to see data.

Assign and edit Group roles

These permissions apply to Flywheel Groups. By default, Group permissions also apply to Projects within that Group (you can configure this setting so projects do not automatically inherit Group permissions).

Assigning a Group role does not automatically add users to Projects in that Group.

To give a user permission to a Group:

Go to Users > choose a user.
Select the Permissions tab, and click Add.
From the dropdown menu, select a Group and select either Admin, Read-Write, Read. .

Role overview

Below is some highlights for what each role can do in Flywheel. See the table below for more information on the permissions included with these roles

Admin:

Manage Group Permissions
Create New Project
Delete Project
Add Users to Group

Read-Write:

Manage Group Permissions
Create new Projects
Delete Projects

Read:

View Projects

Assign and edit Project roles

Project roles allow you to control who can view, edit, and delete data within your Project. You must be an Admin for the Project or a Site Admin to edit Project roles.

If you only want a user to see certain projects under a Group, you can assign the user a role in the Project without giving the user a Group role. To give the user access to a Project, but not the Group associated with the Project, add them from the Permissions screen of the Project.

Custom roles: You can also create custom roles.

To give users permissions to a Project:

Navigate to the Project
Select the Permissions tab.
From the dropdown menu, select user.

Select a permission level for the user. See the table below for more information on the permissions.

Tip

Create a project template to standardize roles and permissions

Project templates allow Site Admins to manage the project's default roles and permissions when creating a new project. See our article to learn more about how to create project template.

Compare project roles and permissions

Table 1. Compare project roles and permissions

Permission	Read-only	Read-Write	Admin	Required
Container Hierarchy (Subject/Session/Acquisition)
View Subject, Session, And Acquisition Metadata	x	x	x	x
Create new Subject, Sessions, and Acquisitions Required if the user is importing data. This does not give user ability to create a Project or copy subjects, sessions, or acquisitions into another project.		x	x
Modify Metadata Includes Project metadata		x	x
Delete Subject, Sessions, and Acquisitions This includes: Files Moving Subjects, Sessions, Acquisitions from a project There are special considerations for deleting Device data. See the considerations below for more detail.		x	x
Delete Project			x
Analyses
View Analyses Metadata	x	x	x
Create Analyses “Ad-hoc Analyses” Upload files to Analysis		x	x
Create Analyses via Job		x	x
Modify Analyses Metadata		x	x
Delete Analyses Includes Files		x	x
Files
View file metadata	x	x	x	x
View file contents	x	x	x
Download files	x	x	x
Create and upload files		x	x
Modify file metadata		x	x
Delete non-device files For example, data that originated from running a gear. .		x	x
Delete device data For example, deleting images uploaded directly from an MR scanner. .		x	x
Tags
View Tags	x	x	x	x
Create, modify, and delete Tags		x	x
Notes
View Notes	x	x	x	x
Create, modify, and delete Notes		x	x
Project Permissions
View Project permissions	x	x	x	x
Create, modify, and delete Project permissions		x	x
Data views
View Data View and results	x	x	x	x
Create, Modify, and Delete Data Views		x	x
Session Templates
View Session Templates and results	x	x	x	x
Create, modify, and delete Session Templates		x	x
Gear rules
View Gear Rules	x	x	x	x
Create, modify, and delete gear rules			x
Jobs- Gear runs
View jobs Includes job metadata, configuration, and logs	x	x	x	x
Run and cancel jobs (utility)		x	x
Cancel other users and system jobs			x
Group Administration- Projects
Create Projects			x
Delete Projects			x

{[{category.name}]}