# Permissions

> Control who can see and change each dashboard and app.

Access in Filament works at two levels. Your [user type](https://filamentanalytics.com/docs/user-types) sets what you can do across the account, like building dashboards or connecting apps. **Sharing** sets which dashboards and apps you can open. You need both: a Member can build dashboards, but can only open a colleague's once it's shared with them.

### What Can Be Shared

| Item           | How it's shared                                                                                         |
| -------------- | ------------------------------------------------------------------------------------------------------- |
| **Dashboards** | One at a time. Charts follow their dashboard's sharing.                                                 |
| **Apps**       | Each connected app on the **Apps** page has its own access list.                                        |
| **Threads**    | Private to you. You can create a public link, but you can't share a thread with colleagues in Filament. |

### Access Levels

#### Dashboards

|                                   | Owner | Can edit | Can view |
| --------------------------------- | :---: | :------: | :------: |
| Open the dashboard and its charts |   ✓   |    ✓     |    ✓     |
| Change charts and layout          |   ✓   |    ✓     |    –     |
| See history                       |   ✓   |    ✓     |    –     |
| Share the dashboard               |   ✓   |    ✓     |    –     |
| Delete the dashboard              |   ✓   |    ✓     |    –     |

The **Owner** is the person who created the dashboard. Anyone with **No access** won't see it in their list.

#### Apps

|                                             | Can manage | Can view |
| ------------------------------------------- | :--------: | :------: |
| Use the app's data in charts and with Filly |     ✓      |    ✓     |
| Change settings, reconnect and upload files |     ✓      |    –     |
| Remove the app                              |     ✓      |    –     |

Only Admins can choose who has access to an app.

### Who You Can Share With

| Share with               | Who's included                                                  | Dashboards       | Apps       |
| ------------------------ | --------------------------------------------------------------- | ---------------- | ---------- |
| **Specific people**      | Anyone in the account, by name or email, including Client users | Can view or edit | Can view   |
| **User groups**          | Everyone in the group. See [User Groups](#user-groups).         | Can view or edit | Can view   |
| **Admins**               | Every Owner and Admin                                           | Can view or edit | Can manage |
| **All members**          | Every Owner, Admin and Member, but not Client users             | Can view or edit | Can view   |
| **Client users**         | Every Client user. Client accounts only.                        | Can view         | Can manage |
| **Anyone with the link** | Anyone, without logging in. See [Public Links](#public-links).  | Can view         | –          |

Client users only ever view dashboards, whatever level they're given. And there's no back door for admins: they see a dashboard only if it's shared with them, their user group, **Admins** or **All members**.

### User Groups

User groups let you share with a team rather than a list of names. Give the Finance group the Xero app and the finance dashboards once, and your new bookkeeper gets all of it the day an admin adds them to the group.

- **Setting up.** Admins create groups under **Account › User groups** with **New group**, then choose each person's group from the dropdown on their row in **Members**. Each person can be in one group at a time.
- **Access adds up.** Removing a group from a dashboard doesn't affect access someone has directly, through another group, or through **Admins** or **All members**.
- **User types still apply.** A group never lets a Member connect apps, and a Client user in a group with edit access still only views.
- **Renaming** a group keeps its access. **Deleting** a group unassigns its members and removes everything shared with it. Access they have in other ways stays.
- **Groups aren't in the defaults.** New dashboards and apps aren't shared with a group until someone shares them.

### Default Settings

|                                     | New dashboards                          | New apps   |
| ----------------------------------- | --------------------------------------- | ---------- |
| The person who created or connected | Owner                                   | Can manage |
| **Admins**                          | No access                               | Can manage |
| **All members**                     | No access                               | Can view   |
| **Client users** (client accounts)  | Follows **All members**, up to Can view | Can manage |

- **New dashboards are private** until shared. Admins can change this under **Account › Dashboard sharing defaults**, setting **Admins** and **All members** to **No access**, **Can view** or **Can edit**. Changes apply only to dashboards created afterwards.
- **Agency accounts** can click **Apply now** to copy their defaults to every client account. This replaces each client's current defaults, and again only affects new dashboards.
- **In client accounts**, with the private default, Client users won't see a new dashboard until you share it with them individually or with **Client users**.
- **Duplicated dashboards** and dashboards created from a template always start private.
- **Threads** are always private to the person who started them.

### Where to Control Permissions

| To change                 | Go to                                                                                    |
| ------------------------- | ---------------------------------------------------------------------------------------- |
| **A dashboard**           | The **Private**, **Shared** or **Public** button in the dashboard's header.              |
| **An app**                | **Manage access** in the app's menu on the **Apps** page. Admins only.                   |
| **Dashboard defaults**    | **Account › Dashboard sharing defaults**. Admins only.                                   |
| **User types and groups** | **Account › Members** and **Account › User groups**. See [User Types](https://filamentanalytics.com/docs/user-types). |

In a dashboard's share dialog, change or remove access under **People and groups with access**, add someone with **Share with people or groups**, and publish with **Create a public link**. You need edit access to share, and Client users can't share.

### How Dashboard and App Access Work Together

To see a chart's data, you need access to the dashboard **and** to every app the chart uses. If you can't view one of its apps, that chart won't load for you, but the rest of the dashboard still works.

The same check applies everywhere data is read: Filly, the MCP server, filters and exports. Filly only sees and queries the apps you have access to.

### Public Links

A public link lets someone outside your account, like a funder, board member or client, open a dashboard without logging in. Links are always view-only, and you can turn one off at any time.

| Option              | Choices                                                |
| ------------------- | ------------------------------------------------------ |
| **Link expiration** | 1 day, 7 days, 30 days or **Never expires**            |
| **Password**        | Optional. Viewers enter it before the dashboard opens. |

**A public link shows data using the access of the person who created it.** That means:

- **It's the one way around app restrictions.** Anyone with the link sees what its creator can see, including apps they couldn't otherwise open. On dashboards built on sensitive data, add a password or an expiry date, or don't create a link.
- **It follows the creator's current access.** If the creator loses access to one of a chart's apps, that chart stops loading on the link. If they leave your account, none of the charts load. To fix this, turn the link off and on again under your own access. This creates a new URL, so send it out again.

### Common Scenarios

#### An agency admin who doesn't need everything in every client

Sam is an agency admin, so Sam is automatically an Admin in every client account and can manage users and apps there. Sam still only sees dashboards shared with Sam, Sam's user group or **Admins**.

- **To show admins every new dashboard** in a client, set **Admins** to **Can view** or **Can edit** in that client's **Dashboard sharing defaults**.
- **To keep them out**, leave it at **No access** and share dashboards with people or groups instead.

Sam can still ask Filly about any client's data from the agency account. For someone who shouldn't see client data at all, see [a member who should only work on certain clients](#a-member-who-should-only-work-on-certain-clients).

#### Giving a client only the dashboards that are ready

With the private default, the client sees nothing while your team works. When a dashboard is ready, open the share dialog and add the client's contact under **Share with people or groups**. They get view access, even if you pick Edit. To share with everyone at the client at once, set **Client users** to **Can view** instead.

#### Letting everyone in a client account see new dashboards

Set **All members** to **Can view** in the client's **Dashboard sharing defaults**. Every new dashboard is then visible to your team and, view-only, to the client's users.

#### A member who should only work on certain clients

Keep them as a **Member** in your agency account, then add them from each relevant client's **Account › Agency members** card. They won't see the other client accounts at all.

#### A team with its own apps and dashboards

1. Create a **Finance** user group and add the team to it.
2. On the Xero app, choose **Manage access**, set **All members** to **No access** and add the Finance group.
3. Share the finance dashboards with the group.

When a new bookkeeper starts, an admin adds them to Finance and they get the lot.

#### Keeping payroll data to a few people

Open **Manage access** on the payroll or HR app and set **All members** to **No access**. Only Admins and the people or groups you add can use it. Charts built on it won't load for anyone else, and Filly won't use it in their conversations.

The exception is a public link: if someone with access publishes a dashboard that uses the app, anyone with the link sees that data. Keep links on sensitive dashboards password-protected and set to expire.