To access Express Role Administration, navigate to Administration > Express Permissions > Express Role Administration.
The Express Role Administration page is where administrators manage the roles that control what end-users can access. Express roles support a parent-child hierarchy, default permission levels, group assignments, and full submission access for privileged roles.
Important: Managing Express roles requires administrative permissions. Administrators needing access should contact their environment administrator.
<DocsAdminListCanvas preset="EXPRESS_ROLES" actionAnchors={{ "Add Role": "adding-a-role" }} />
Role List
The role list displays all Express roles in the environment. Use the search bar to filter roles by name. Each row displays the following:
| Column | Description |
|---|---|
| Role | The role name. |
| Description | The role description, if provided. |
| Permission | The default permission level assigned to end-users with this role. |
| Actions | Role-level actions. See Role Actions below. |
Page Actions
| Action | Description |
|---|---|
| Add Role | Opens a new page to create a new Express role. |
The toolbar also includes the following actions:
| Action | Description |
|---|---|
| Promote All Roles | Promotes all Express roles to another environment. |
| View Role Hierarchy | Opens a dialog showing the parent-child hierarchy of every Express role, with collapsible branches. |
Role Actions
| Action | Description |
|---|---|
| Edit | Opens the role form to update its settings. |
| Delete | Permanently removes the role. A role cannot be deleted if it is currently assigned to any end-users. |
Adding a Role
Click Add Role to open a form with the following settings:
| Setting | Description |
|---|---|
| Role Name | A unique identifier for the role. Cannot be changed after creation. |
| Role Description | An optional description of the role's purpose. |
| Select Parent | Assigns a parent role (a role whose permissions this role inherits). A role with a parent is called a child role. Child roles inherit all permissions from their parent while also carrying any permissions assigned directly to them. |
| Select Default Permission | Sets the baseline access level for end-users with this role. |
| Full Submission Access | Grants unrestricted read and write access to all submissions. |
| Add to Group(s) | Search for and assign the role to one or more Express groups. |
Default Permission
The default permission sets the baseline access level for end-users assigned this role.
| Option | Description |
|---|---|
| No Access | End-users cannot view or interact with any submissions. |
| Read-Only | End-users can view submissions but cannot modify them. |
| Write | End-users can view and modify submissions. |
Full Submission Access
When enabled, Full Submission Access grants unrestricted read and write access to all submissions in the environment, overriding role hierarchy, group membership, and field-level permissions.
Important: Full Submission Access bypasses all other access controls. Enable it only when this level of access is explicitly required.
Enabling Full Submission Access automatically sets the Default Permission to Write and prevents it from being changed.
Role Hierarchy
Express roles support a parent-child hierarchy. A child role inherits the permissions of its parent. To assign a parent, select one from the Select Parent drop-down when creating or editing a role.
Select View Role Hierarchy from the toolbar to see the full hierarchy across all roles in the environment.
Changelog
| Date | Change |
|---|---|
| 2026-08-27 | Corrected View Role Hierarchy access — inline toolbar button, not ellipsis drop-down (EN-8047). |
| — | Initial publication. |