Skip to main content
Permissions combine a user’s org role with resource-level access. Use roles to set a user’s default workspace capabilities, then use the share sheet to control access to specific pages, sections, blocks, scenarios, and database columns.

User roles

Runway roles are hierarchical: Owner, Admin, Manager, Member, Guest, then Anonymous user. Invited users default to Member unless you choose another role. For the canonical role and access matrix, see Roles and access.
RoleDefault access patternDistinctive behavior
OwnerFull workspace accessOwns the workspace and cannot be modified from sharing UIs.
AdminFull workspace accessCan configure the model, workspace settings, and workspace info.
ManagerBroad internal modeling access with exceptionsCan trace and edit models, create scenarios, and access shared workspace information.
MemberLimited default accessCan trace models, create scenarios, and access shared workspace information after access is granted.
GuestShared-content access onlyCan view pages and data shared with them.
Anonymous userShare-link visitor access onlyCreated through page share links; never selectable as a normal role.

Owner

Owners have workspace-level control and are treated as a protected system role in sharing. Use Owner sparingly for the people accountable for the workspace itself.

Admin

Admins can configure the model, workspace settings, and workspace info. This role is usually for finance or operations team members who administer Runway.

Manager

Managers are internal collaborators who need broad modeling access without full admin control. They can create scenarios and work with shared model information, with exceptions for sensitive workspace areas.

Member

Members are internal collaborators who need access to specific shared resources. They can trace models and create scenarios where their access allows it.

Guest

Guests are external or limited collaborators who should only see content explicitly shared with them.

Anonymous user

Anonymous users are provisioned through page share links. They are not invited through the role picker and should be managed through link security settings.

Access levels

Open the Share sheet to manage resource access. The sheet has People and Links tabs. The People tab includes an invite field with placeholder Email, name or group, separated by commas, an Add button, an access-level dropdown, Notify via email, and an optional message field. The org-wide row appears as Everyone at {orgName}. The standard access levels are:
Access levelMeaning
Full accessCan edit the resource and manage its access where the resource supports those actions.
Can editCan edit the resource but cannot manage sharing or deletion.
Can viewCan view the resource without editing it.
No accessCannot view or access the resource.
Different resource types offer different subsets of access levels:
Resource typeAccess levels offered
PageFull access, Can edit, Can view, No access
SectionFull access, Can view, No access
BlockFull access, Can view, No access, plus drill-in control where applicable
ScenarioFull access, Can view, No access, with merge control where enabled
Database columnCan view, No access
For the complete capability rules, use Roles and access as the canonical matrix. Use the Links tab to create and manage page links. Link rows include Copy share link and security options:
  • Require login to access
  • Require password
  • Guest invite link
Share links exist only on pages. If login is not required, a Password field can be used when password protection is enabled.

Groups

Groups are created and managed from the share sheet. Search for a group, or type a new name and choose Create “{name}” group. Group rows include actions such as Add users to group and View group.

Inherited access

Resources can inherit access from a parent resource. Inherited rows show People in a parent resource. If you override inherited access, Runway prompts Change access for {resourceName} and confirms with Change and unlink. When a resource is unlinked from inherited settings, Runway shows a banner that its share settings are unlinked from default access settings. Use Relink or Reset to default access level to return to inherited access.

What’s next