Roles and permissions

Tato's new roles and permissions will be rolling out throughout July 2026. Tato's team will work with you to make sure you have a smooth migration.

Access in Tato works at two levels: your organization (the whole Tato account) and each individual project. Most people only need to think about project roles. Organization roles are for the few people who manage the account itself.

The Tato team will work with you to assign an owner at the organization level, who will be able to manage the other roles and permissions.

Organization roles

These control who can manage the overall account, create projects, and add people.

Owner — Full control of the account. Can manage every project and every person, and can grant Owner or Admin access to others. Best for a small group, typically IT or the account sponsor.
Admin — Can create and archive projects, invite people (up to Editor level), and assign roles. Best for trusted leads who oversee project managers.
Editor — Can configure their projects and manage the people in them. They only see their own projects, not everyone else's.
Viewer — Can log in and see the projects and activity they're part of. The baseline role for anyone who just needs to participate.

Project roles

These control what someone can do inside a specific project. This is where most day-to-day access is set.

Admin — Runs the project. Can set it up, archive it, invite people, and assign any role up to Admin. Best for the project manager and their close collaborators who manage access.
Editor — Does the hands-on work. Can upload content, create and edit project records, configure the project, and make changes through the chat assistant. Best for workstream leads who build and run reports.
Viewer — Can see everything in the project, use the chat, and run existing reports, but can't change anything. Best for people across the organization who want to follow the project. Typically anyone with your company email domain.
Member (Guest) — Can only see the activities and summaries they personally took part in. Best for outside participants, such as partners or vendors on a different email domain.
No access — Cannot see any of the project's content.

Have questions about how this affects your team? Reach out to your Tato contact or support@tato.co to plan your migration.