Roles and permissions

Every member has one role, which sets what they can view and change in each area of Mercora.

Every member has one role: a set of permissions, one per area of Mercora. This page explains the built-in roles and how to create your own under Settings → Roles, which is for workspace admins.

A role only opens areas whose module is turned on, so set up your modules first.

Permission levels

• None: the area is hidden.
• View: the member can see the area but not change it.
• Edit: the member can make changes: upload, correct, match, approve, create and so on.

Dashboard and Reports only go up to View. Copilot is None or Use.

Built-in roles

Role	Access
Admin	Everything, plus members, roles, settings, modules, integrations and API keys.
Operator	Edit on every area except User access, Email and Files.
Viewer	View on every area (and Use for the Copilot) except User access, Email and Files.

User access, Email and Files are left out on purpose: managing members and acting in the workspace’s shared mailboxes and files are things an admin grants deliberately. You can adjust a built-in role’s permissions, but not delete it or change whether it’s an admin role.

Create a custom role

1. Click New role

   Go to Settings → Roles and click New role. Give it a Name, such as “Trade finance”, and optionally a Description.

2. Choose a starting point

   Under Copy permissions from, pick No access — start empty or an existing role. Copying happens once and never turns on Workspace admin.

3. Set each permission

   Choose None, View or Edit. Use Set all to… for a whole group, or Search permissions… to find one.

4. Click Create role

   Then assign it to members under Members.

A new role, starting empty. Invoice sync shows a Module off badge and stays greyed out until Documents is at least View.

An indented permission only takes effect while its parent is at least View. A permission whose module is off shows Module off; you can still set it for later.

To delete a custom role that members still use, choose a role to Move members to first.

What each permission covers

Permission	Covers
Dashboard	Overview cards on Home.
Documents	Upload, review and approve documents. Indented under it: Invoice sync, B/L sync and Contract sync to a connected system.
Trades	Trade list, details, legs and reconciliation.
Contracts	Contracts as standalone records.
Shipments & logistics	Shipments, containers, vessels and the trade’s Shipments tab.
Financials	Invoices, payments, settlements, netting and the cost & income plan.
Counterparties	Counterparty records, KYC, terms and balances.
Derivatives	The futures ledger.
Reports	Analytics, the P&L and the overdue-payments report.
Deal Capture, Freight Rates, Hedging	Each workflow’s items in the Inbox. Deal Capture and Hedging each have an External sync permission.
Automations — management	Create, edit and run automations.
Automations — results	Read and act on automation results.
Copilot	Use the assistant, limited to what the role can already reach.
Email	Read connected mailboxes and Teams channels. Edit also sends and posts, each after an Approve.
Files	Read connected SharePoint files and spreadsheets. Edit also changes them, each after an Approve.
User access	View shows Members and Roles. Edit also lets the member change others’ roles, within limits.

Some features need more than one: pushing an invoice to an external system needs Edit on Documents and Invoice sync, plus both modules on.

Admins

Turning on Workspace admin for a role gives full access everywhere and ignores the permission grid.

Mercora won’t let you lose your last admin: you can’t demote or remove them, turn off Workspace admin on their only role, or delete it. Make someone else an admin first.

Next steps

• Members: invite teammates and give each a role.
• Modules: turn on the areas your roles grant.