# Permissions and sharing

> How roles, drives, channels and sharing decide who can see what.

Source: https://docs.coline.app/workspace/permissions

Access in Coline comes from three places, checked together: your **role** in the workspace, the **drives and channels** you've been added to, and what's been **shared** with you directly. The same rules apply to Kairo, crew members, apps and API clients acting for you: they can never reach more than you can.

## Roles

| Role   | Can                                                                                         |
| ------ | ------------------------------------------------------------------------------------------- |
| Owner  | Everything, including billing, transferring ownership and deleting the workspace            |
| Admin  | Full access to the workspace: members, roles, apps, crew and settings                       |
| Member | Everything shared with members: public channels, shared drives, and what's shared with them |
| Guest  | Only what's shared with them, such as specific channels and files                           |

Admins can create **custom roles** in **Settings → Roles and permissions** and grant them specific permissions, grouped into areas such as members and invites, roles, guests and external access, billing, integrations, crew, memory, and data and security policies. Roles have a priority order.

## Drives and files

* **Shared drives** are open to the workspace by default, or **restricted** to the people and roles added to them. Grants can allow read, write, or manage.
* **Personal drives** belong to one member.
* **Team drives** are open to everyone in the [team](/workspace/overview#teams).
* Files inherit their drive's or folder's access, or can be **restricted** to specific people.

## Channels

Public channels are open to every member. Private channels only let in the people added to them. **Roles and permissions → Exceptions** lists channels and drives that differ from the role defaults.

## Sharing a file

From a file's **Share** menu:

| Option                     | Who can open it                             |
| -------------------------- | ------------------------------------------- |
| **People with access**     | Members and people you invite by email      |
| **Restricted** link        | Only people already added                   |
| **Coline users with link** | Anyone signed in to Coline who has the link |
| **Anyone with link**       | Anyone with the link, without an account    |
| **Publish to web**         | A public page, optionally with a password   |

Publishing to the web needs a paid plan.

## Sharing channels with other companies

[Coline Connect](/connect) shares a channel with people outside the workspace. In **Settings → External sharing**, admins choose who can share channels (any member, channel managers, or only admins), limit which company domains channels can be shared with, and decide whether outside people can bring their colleagues.

## Guests

Admins can turn guest access on or off, and convert guests to full members.