Skip to main content

​
Permissions

Permissions decide what each member of your team can do. Roles, delegation, and custom roles are all managed on the Access & Roles page, in three layers: preset roles for every coach, per-assistant delegation for every coach, and a custom-role builder on Head Coach and above.

​
Roles and scopes

A permission is never granted in the abstract. Every grant carries a scope that decides how much data it covers: This is why a head coach and an assistant can both hold “view athlete profile” and see very different rosters: the head coach holds it at org scope, the assistant at relationship scope.

​
Preset roles

The built-in roles you can assign on Access & Roles: Only an existing org owner, or Saturday staff, can assign the Owner role. A Program Admin cannot promote anyone to Owner, including themselves.

​
How a permission check resolves

For any given action, Saturday resolves in this order and stops at the first answer:
  1. A per-user deny on that permission. A deny always wins, whatever the role says.
  2. A per-user grant, at the scope it was granted.
  3. The union of the member’s role grants, taking the widest scope any of them provides.
  4. A custom role definition, for roles that are not built in.
  5. Otherwise, denied.

​
Per-assistant delegation, on every tier

Three delegation axes let a head coach hand a specific power to a specific assistant without building a custom role. All three are available on every tier, and they compose: turning one on never disturbs the others.
  • Billing. Lets an assistant cover and uncover their assigned athletes’ memberships. A second, separate toggle governs ending an org-paid coverage arrangement. Turning on billing delegation alone never grants the org-paid one.
  • Setup. Lets an assistant adjust an athlete’s Setup: carriage, fill and mix, gluc:fruc ratio, and eco-mode. Held by a head coach by default, never by an assistant unless granted.
  • Governance. Grants org powers one at a time: branding, SAML configuration, audit-log reading, API-key management, webhook management, org-hierarchy management, and management of the custom roles themselves.

​
Custom roles, on Head Coach and above

Head Coach, Business, and Enterprise get the custom-role builder on Access & Roles: name a role, then check exactly which permissions it carries and at what scope. Assign it to as many team members as you like. The same tier unlocks per-user permission overrides and the effective-access viewer, which shows what a given member can do once roles, grants, and denies have all been applied.

​
What no role can ever grant

One permission does not exist, deliberately: viewing an athlete’s raw AI conversations. It is absent from the permission catalog, so there is nothing for the custom-role builder to check. Athletes’ raw AI chats stay private; their derived plans and reports are shared with you. See The AI report.

​
Organizations, audit, and hierarchy

  • Org hierarchy is available on Head Coach and above: create sub-organizations, move coaches and athletes between them, and scope admins per sub-org. Permissions and coverage respect the hierarchy.
  • The audit log is a Business and Enterprise capability, scoped to the org owner. It records consequential actions across the org: who covered whom, who changed a Setup and what changed, who issued a refund, who edited alert rules.

​
See also