Roles and Permissions

Plan availability (2026-07-23): the seven built-in roles are available on every plan. Creating, cloning, or editing custom roles requires the Growth plan or higher — on a lower plan the custom-roles section shows an inline upgrade banner. Custom roles that were already assigned keep working after a downgrade (nobody loses access), and deleting a custom role is always possible.

EmbayLMS controls what each person can do through roles. This guide explains the seven built-in roles, how to assign them, and how to build your own custom roles from the granular permission catalog.

You manage all of this under Settings → User Management → Roles and Permissions.

Prerequisites

• You are an Admin or Owner (both can open Roles and Permissions).
• Only an Owner can grant Owner-level permissions (Billing and the account-level Settings pages).

The seven built-in roles

Built-in roles are fixed and read-only — you can’t edit them, but you can clone any of them into a new custom role. Where a role is scoped, it only reaches the courses, groups, or people it is assigned to; the scope is enforced on the server for every action.

Owner vs. Admin. The important line is Billing and the account-level Settings. Admins run the platform day to day; Owners hold the account-level controls. This keeps administration delegable without handing over billing or security.

Assign a role to a user

1. Go to Users and open the person’s profile.
2. Click Edit, choose their primary role in the Role field, and click Save changes.
3. To give someone more than one role (permissions are cumulative), use the Roles panel on their profile to add extra built-in or custom roles, then click Save roles.

A role change is read when the person signs in, so ask them to sign out and back in to pick it up.

You can only assign a role at your own level or below — an Admin cannot create an Owner, and a Group Admin cannot create an Admin.

Setting up an instructor

Instructor takes two steps, and both are required:

1. Give them the Instructor role — either as their primary Role, or added in the Roles panel. This grants the permissions (course content, sessions, grading, analytics).
2. Assign them to courses — open each course, go to the Instructors tab, and add them. This defines which courses those permissions reach.

Do them in that order. The tab’s search lists only people who already hold the Instructor role, so someone without it does not appear there at all — the assignment on its own would confer nothing.

Only Owners and Admins assign instructors. Group admins can assign roles to their own members, but they don’t see the Instructors tab: an instructor assignment reaches every learner in the course, well beyond the group admin’s groups. (A custom role that adds user:assign_role to an instructor reaches only that instructor’s own courses.)

An instructor’s admin screens are scoped to their assigned courses throughout: the course list and folder tree, the enrolled learners on each course, the Planned sessions list, the grading queue, and Analytics all show their courses only.

Instructors edit courses; they do not create or configure them. Outside their remit:

What a manager can do with sessions

A Manager sees the Planned sessions list and can open any session, but the page is read-only for them plus one thing: enrolling their own team.

The scope is the report chain: everyone whose Manager field points at them, directly or through other managers. A name outside the chain is refused on the server regardless of what the page shows.

Custom roles cloned from Manager. Cloning copies the permission list at the moment you clone. A role cloned before 2026-09-11 does not gain the session permissions automatically — edit it and tick session:view and enrollment:create if you want the same behaviour.

Create a custom role

Use a custom role when the built-ins don’t fit — for example a “Reporting Analyst” who can only view and export analytics.

1. Open Settings → User Management → Roles and Permissions.
2. Either click New role to start from scratch, or click Clone on any role (built-in or custom) to start from its permissions.
3. Give the role a name.
4. Tick the permission scopes it should have. Scopes you can’t grant yourself are greyed out (you can never grant a permission you don’t hold).
5. Save. Assign the role to users from their profile.

Permission catalog

Permissions follow a resource:action format and the editor lists them by resource (for example course, content, user, group, enrollment, session, skill, quiz, grading, certificate, template, report, messaging, ecommerce, role, one group per Settings sub-page, and billing). Pick exactly the actions a role needs.

Troubleshooting