Skip to main content
Crovant grants access by role, never by individual. Each role corresponds to a rank in the Roblox group, so promoting someone in Roblox is what gives them more access here.

​
Enable panel access

1

Open Configuration → Roles & Permissions

Every rank imported from the group is listed.
2

Turn on panel access for staff roles

Panel access is the gate: without it a role can sign in but reaches nothing.
3

Assign permissions per role

Grant only what each role needs. Permissions are additive.
Panel access defaults to off for every role, including ones created when the workspace was set up. A staff member reporting “I logged in but there’s nothing there” is nearly always a role without panel access.

​
How a request is authorised

Two things are checked, and they fail differently:
Sessions come from Roblox OAuth and are signed. No session, or an expired one, gives 403 Forbidden with reason no_session.
With a valid session but insufficient permissions you get 403 Forbidden with a reason naming what was missing — not_owner for owner-only operations, not_superuser for superuser ones.

​
Owners and superusers

Beyond ordinary roles there are two elevated levels:
  • Owner — the group owner. Can transfer ownership and change any setting.
  • Superuser — optional; where unset, owners are treated as superusers.
These are configured for the deployment rather than per workspace, and they are what admin endpoints check.

​
Groups within a workspace

Staff can also be collected into groups for assignments and training cohorts. These are a Crovant concept and do not come from Roblox — they sit alongside roles rather than replacing them.