Permissions

Platform permissions combine four layers: role, module permissions, project membership, and task relationship. For how to configure module permissions, see Module Permissions.

Permission Hierarchy

Permission Composition

Layer	Determines	Configuration entry
Role	Which sidebar menus are visible	Edit user → Role
Permissions	Narrows the role by feature key; values are Deny, Read Only, and Read & write	Edit user → Module permissions
Project membership	Which projects and data are accessible	Project → Members
Task relationship	Which tasks are accessible and whose status can be changed	Task assignment

The role determines whether a menu entry appears; module permissions determine whether the pages and APIs behind that entry are available. When a menu is visible but its module permission is Deny, the API returns 403 and the page guard redirects the request. Administrators are exempt from module permissions and always have read & write access to every module.

Roles and Hierarchy

The role hierarchy determines account management rights: an administrator can edit any user, while other roles can only edit users whose rank is strictly lower than their own.

Role	Code	Rank	Purpose
Administrator	ADMIN	100	All features and configuration
Project Manager	MANAGER	50	Projects, tasks, export
Collector	COLLECTOR	20	Collection and upload
Auditor	AUDIT	20	Annotation result review
Annotator	USER	10	Annotation execution
Guest	GUEST	5	Sign-in only, with no available business pages

Roles and Visible Menus

The table below lists the roles that can see each sidebar entry.

Entry	Administrator	Project Manager	Collector	Annotator	Auditor
Overview	Allow	Allow	Allow	Allow	Allow
Data	Allow	Allow	Allow	Deny	Deny
Upload	Allow	Allow	Allow	Deny	Deny
Collect	Allow	Allow	Allow	Allow	Allow
Annotation	Allow	Allow	Deny	Allow	Allow
Quality Control	Allow	Allow	Allow	Deny	Deny
Dictionary	Allow	Allow	Deny	Allow	Allow
Chart	Allow	Allow	Deny	Allow	Allow
Skills	Allow	Allow	Deny	Deny	Deny
Export	Allow	Allow	Deny	Deny	Deny
LeRobot Studio	Allow	Allow	Deny	Deny	Deny
Training	Allow	Allow	Deny	Deny	Deny
Inference	Allow	Allow	Deny	Deny	Deny
Motion Retargeting	Allow	Allow	Deny	Deny	Deny
Project	Allow	Allow	Deny	Deny	Deny
Users	Allow	Allow	Deny	Deny	Deny
Robot	Allow	Allow	Deny	Deny	Deny
Device	Allow	Allow	Allow	Deny	Deny
Cloud	Allow	Deny	Deny	Deny	Deny
Workflow	Allow	Allow	Deny	Deny	Deny
Plugin	Allow	Allow	Deny	Deny	Deny
Trash	Allow	Deny	Deny	Deny	Deny
Quotas	Allow	Deny	Deny	Deny	Deny
System Settings	Allow	Deny	Deny	Deny	Deny
Operations	Allow	Deny	Deny	Deny	Deny

The table above reflects the visibility range determined by role. System Settings can also hide specific entries. A visible entry does not imply that operations are allowed; an operation also requires the corresponding module permission to be Read Only or Read & write.

Roles and Operation Permissions

Roles and Task Status Permissions

Annotation tasks have six statuses. The next status allowed for each status, the roles that can set it, and the identity restrictions for annotators and auditors are defined by Task Status and Status Change Permissions in Annotation Tasks; this page does not repeat them.

Roles and Data Operation Permissions

The table below gives the default role range for data-related operations. Grant required means the role does not include the capability by default; an administrator must set the corresponding module permission to Read Only or Read & write.

Operation	Administrator	Project Manager	Collector	Annotator	Auditor
View dataset list	Allow	Allow	Allow	Grant required	Grant required
Upload data	Allow	Allow	Allow	Grant required	Grant required
Annotate data	Allow	Allow	Allow	Allow	Allow
Delete data	Allow	Allow	Only self-uploaded data	Deny	Deny
Export data	Allow	Allow	Grant required	Grant required	Grant required
Manage cloud storage	Allow	Project level only	Deny	Deny	Deny

Project level only means a project manager can create and maintain cloud storage connections scoped to a specific project; global connections, which are visible to all projects, can only be created by an administrator. The connection scope is set by Is Open and Project on the connection; see Cloud Storage for details.

While data belongs to a task in Submit Data status, annotation is locked and neither members nor non-members can annotate it again.

Project Types and Data Operations

The table below compares the data operation scope for member projects and public projects, where the account is a non-member.

Operation	Member project	Public project, non-member
View dataset	Allow	Allow
Annotate dataset	Allow	Deny
Export dataset	Allow	Determined by the "Shared data export" setting; Allow by default
Edit data tags	Allow	Deny by default
Delete dataset	Allow	Deny
View task	Allow	Allow
Create or edit task	Allow	Deny

For public projects, an administrator changes the task status on behalf of non-members; for member projects, annotation and review are performed by the people related to the task.

Related Pages

Page	Purpose
Module Permissions	Module permission groups and configuration steps
User Management	Role assignment and account creation
Projects and Members	Project visibility range and member management
Annotation Tasks	Task state machine and task details