Skip to main content
Windmill uses several controls together to determine access. A member’s role controls workspace administration. The org chart defines manager scope. Each feature and connected system can also apply its own visibility rules.

​
Roles and capabilities

Windmill has five roles: Admin, HR Admin, Integration Manager, Data Analyst, and Team Member. Managers do not have a separate role. A Team Member can be a manager when the org chart gives them direct or indirect reports.
When Allow managers to invite reports is enabled in Settings > Security, managers can invite direct and indirect reports as Team Members. This permission does not let a manager invite people outside their reporting subtree or assign an administrative role.

​
Admin

Admins have all workspace capabilities. They can manage company settings, integrations, members, roles, billing, the org chart, groups, and company features. Admin status does not by itself provide unrestricted access to all employee content. Source permissions and feature-specific privacy rules still apply.

​
HR Admin

HR Admins can manage people operations and many company settings. This includes members, roles, billing, single sign-on (SSO), integrations, the org chart, groups, access delegation, performance review cycles, company-wide 1:1 templates, and supported company features. They can also view analytics for all employees. HR Admin status does not provide unrestricted access to employee content.

​
Integration Manager

Integration Managers can manage company integrations, billing, and SSO settings. They cannot open the Members page, invite members, or change roles. This role does not grant permission to manage the org chart, create groups, manage access delegation, or manage performance review cycles. They can edit an existing group if its sharing grants them edit access. They do not get company-wide employee visibility from this role.

​
Data Analyst

Data Analysts can view analytics for all employees. They cannot manage members, billing, integrations, the org chart, or other company settings.

​
Team Member

Team Members use the standard Windmill features that their company enables. They can view their own information. Managers can also view supported information for people in their reporting subtree.

​
Group access

Group sharing controls access to each group’s full roster separately from workspace roles. New groups are company-visible by default. Members with Can edit access can manage an existing group, including its sharing and archive action, within the restrictions of its type. Only Manual groups allow direct member changes; Smart groups use rules, and Synced and SCIM groups have source-owned names and membership. Admins and HR Admins can create groups, link integration groups, and access all groups, including Restricted groups. Their built-in access cannot be removed in the sharing dialog. Other members need an appropriate sharing grant to view or edit a restricted group. Sharing grants are additive. Removing a person’s direct grant doesn’t remove access they receive through company, manager, group, or reporting-line sharing. Group membership alone doesn’t grant edit access, and access to a group doesn’t grant access to surveys, reviews, or reports that use it. See Groups and permissions for defaults and sharing instructions.

​
Changing a member’s role

Admins and HR Admins can change roles. Only Admins can assign the Admin role or change the role of an Admin. Nobody can change their own roles.
1

Go to Settings > Members

Open Members.
2

Open the member actions menu

Find the member and select Change role from the row actions menu.
3

Select the new role

Review the role description, then select the role that the member needs.
4

Update the role

Select Update role to save the change.
An Admin has all workspace capabilities. Only assign this role to a trusted member who needs full workspace administration.

​
Org chart scope

The org chart defines each manager’s reporting subtree. This scope includes direct and indirect reports. The reporting subtree is one input to access. It does not override feature privacy or source-system permissions. For example, a manager relationship does not provide access to a private Google document, a private Slack channel, or private 1:1 content. If an employee has no manager, no upstream manager receives access through the org chart. This is normal for a top-level leader. Other role and feature permissions can still apply.

​
Manager changes

A manual manager change updates the old and new reporting scopes.

​
Content visibility

Windmill combines these rules when it checks content access:
  • Workspace role: Controls administrative actions and specific broad permissions, such as company-wide analytics.
  • Org chart: Defines manager and reporting-subtree scope.
  • Feature rules: Reviews, Pulses, 1:1s, and other features can have their own sharing and privacy settings.
  • Source permissions: Connected content can keep the access rules from its source system.
  • Delegation: Adds supported manager-like visibility for a selected reporting scope.
An administrative role does not replace the other controls.

​
Feedback access

Feedback has its own audience rules. Authors can select from audiences allowed by company settings. Options include the recipient, the direct manager, the manager hierarchy, the recipient and managers, or everyone in the company. Authors retain access to their feedback. Admins and HR Admins can configure Feedback settings and read feedback about other people. This management access does not give them private feedback about themselves. They can read feedback about themselves when its audience otherwise permits access. If a recipient has no manager, they can read Manager only and Manager hierarchy feedback about themselves. Some feedback can hide the author’s identity even when its content is visible. Request access is separate from feedback access. Members can find their own outgoing requests and incoming requests that need their response. Management access does not provide access to requests between other people. See Feedback visibility and settings.

​
1:1 auditability

1:1 content is private by default. Admin or HR Admin status alone does not provide access to all 1:1 notes. When 1:1 auditability is enabled, Windmill can provide read-only access to shared manager-and-report 1:1 history:
  • Managers can audit 1:1s in their reporting subtree when manager audit access is enabled.
  • HR Admins can audit all manager-and-report 1:1s when HR Admin audit access is enabled.
Audit access does not include Private Notes, participant-specific prep topics, Catch Me Up reports, or recording access.

​
Access delegation

Access delegation gives one member supported manager-like visibility into another person’s reporting subtree. The delegated member can see that person and everyone who reports up to them, directly or indirectly — the same downward scope a manager has. It does not extend upward: the delegated member does not gain visibility into anyone above that person in the org chart. It is useful for an interim manager, an assistant, or a People team member who needs a specific reporting scope without an org-chart change.

​
Delegation limits

Delegation can provide access to supported team data and reports. It does not:
  • Provide access to 1:1 notes or agendas
  • Change Google document or meeting permissions
  • Change Slack channel membership
  • Let the delegated member impersonate another member
  • Add permission to edit Pulses or company settings
  • Override feature-specific privacy rules

​
Adding delegation

Admins and HR Admins can add delegation. The manager and the member who receives access must each have an employee record.
1

Go to Settings > Access Delegation

Open Access Delegation.
2

Select Add delegation

Start a new delegation rule.
3

Select the manager scope

Choose the manager whose reporting scope you want to share.
4

Select the member who gets access

Choose the member who needs the delegated scope, then select Delegate access.
Delegation always resolves against your current org chart, not a snapshot taken when the rule was created. As people move in or out of that person’s reporting subtree, the delegated scope follows along. Changes, including adding or removing a rule, usually take effect within a few minutes.

​
Removing delegation

To remove access, go to Settings > Access Delegation and select Remove next to the delegation rule. Windmill refreshes access right away.

​
Connected-system permissions

For connected content that has source-level access controls, Windmill keeps that permission context. Examples include:
  • A private Google document stays limited to people who can access it in Google Drive.
  • A meeting transcript stays limited by the meeting and source access rules.
  • A private Slack channel does not become visible to people outside that channel.
Some integrations provide company-level activity or usage data instead of user-scoped content. Those integrations use the applicable Windmill feature permissions. For example, Admins, HR Admins, and Data Analysts can view company-wide analytics.

​
FAQs

Admins have all workspace capabilities. HR Admins have broad people-operations and company-setting capabilities, but they do not have every Admin capability. For example, only Admins can assign the Admin role.
Use access delegation when someone needs a supported manager reporting scope. Windmill does not set an end date for a delegation rule. Remove the rule when the access is no longer required.
Yes. Assign the Data Analyst role. This role provides analytics for all employees without workspace administration permissions.
When you change a manager in Windmill, the old manager loses access and the new manager gains access at the same time, usually within a few minutes. When the change comes from your HRIS, access updates after the next sync brings the change into Windmill.
Admins, HR Admins, and Integration Managers can create and manage company integrations. Any member can create a personal integration if they have the required permission in the connected system.
Access ends when the member record is archived. In Windmill, use Remove member in Settings > Members to end access right away. You must do this before you can archive the employee. When your HRIS marks an employee as inactive, Windmill archives their member access on the next sync. Historical data (like past feedback and reviews) is preserved.
Windmill requires at least one active Admin. Assign the Admin role to another active member before you change or remove the last Admin. A member also cannot remove their own member access.
Windmill provides Admin, HR Admin, Integration Manager, Data Analyst, and Team Member roles. Contact support@gowindmill.com if your organization needs a different access model.