Access control: role permissions and member overrides

Adjust what each role can do in Legion Diagnostics, give individual members extra or fewer permissions, and set organization-wide rules.

The Primary Site Administrator decides who can do what on the "Access control" page in "Organization settings".

Role defaults

Every role starts with sensible defaults. Pick a role to see its permissions, grouped by area of the app, change any of them, and click "Save role defaults". Permissions that differ from the standard defaults are marked; click "Reset" to return a role to them.

Member overrides

For a single person, pick the member, adjust individual permissions, and click "Save member overrides". Their own settings take precedence over their role's, which take precedence over the standard defaults.

What cannot be changed

• Some permissions belong only to the Primary Site Administrator, such as managing access control itself, changing members' roles, resetting passwords and inactivating members.
• A few belong only to Primary Site Administrators and Site Managers, such as sending invitations, archiving approved documents, managing site licensure and viewing AI usage.
• A Primary Site Administrator can never have a permission taken away, because they are the last-resort approver for every workflow. Permissions can still be added to them.

Organization-wide settings

The same page holds a few settings that apply to everyone:

• team email notification settings, including email types that cannot be turned off
• AI access, which sets what the assistant may read and change for each role (see AI access and credits)
• document control, which sets whether people are notified about new revisions of linked documents
• QC director review, which sets how many days after the last signed review a new one is flagged as due

You are asked for a reason when you change the QC review setting.