Objective
Give the correct Studio staff identity the permissions and record scope required for its work.
Before you begin
- Ask a Studio administrator to approve the duties and scope. Use your own account with access-administration permission.
- Have the verified Staff user and approved role-template, location, and category identifiers. A pending invitation is managed separately in Team & access.
Instructions
Open Settings > People
Find the teammate under Managed records and open their named Staff profile. Check Staff user, Account status, and Sign-in method before changing the record.
Edit the approved profile fields
Set Account status only to the approved Active or Inactive choice. Require password reset at next sign-in applies to Password accounts; leave it off for Google sign-in. Keep this profile open until you save or select Cancel to discard its edit.
Preview, save, and verify the profile before leaving
Read Effective access preview: compare Current effective access, Proposed effective access, additions, removals, and risk messages. Stop if it reports a self-lockout. If required and approved, select I acknowledge this high-risk access expansion and the affected sessions will be revoked. Select Save record, wait for confirmation, then reopen the named profile and verify the saved fields. Select Cancel to leave this verification edit before opening another record or page.
Open and edit the approved role template
Open Settings > Roles & permissions. Select Edit on the relevant Role template, then check Approved capabilities and Scope. A shared template change can affect every staff member assigned to that template. Change only the approved fields; keep this editor open until you save or select Cancel.
Preview, save, and verify the template before continuing
Compare Current effective access, Proposed effective access, additions, removals, and risk messages in Effective access preview. Stop for a self-lockout. If required and approved, select I acknowledge this high-risk access expansion and the affected sessions will be revoked. Select Save record and wait for confirmation. Select Edit on that same template to verify the saved capabilities and scope, then select Cancel before changing records or pages.
Review assignments or prepare an approved new assignment
Return to Settings > People and compare the existing Role assignment with the approved Staff user and Role template identifiers. Existing assignments in this list do not have an Edit control; ask a Studio administrator for an approved correction path if one is wrong. For an approved new assignment, first select Cancel if a profile edit is open, then choose Record type > Role assignment. Enter Name, Staff user, and Role template using approved identifiers, and keep Identity context set to Staff. Do not add another assignment merely to work around an incorrect one.
Preview, add, and verify the new assignment before leaving
For the new assignment, read Effective access preview and compare current and proposed access, additions, removals, and risk messages. Stop for a self-lockout. If required and approved, select I acknowledge this high-risk access expansion and the affected sessions will be revoked. Select Add record, wait for confirmation, and verify the new assignment’s name and saved staff/template details in Managed records before opening another record or page. Skip this step when no new assignment is approved.
Edit or prepare the approved scope grant
Open Settings > Roles & permissions. Select Edit on the intended Scope grant, or select Cancel to leave any unwanted edit before choosing Record type > Scope grant for an approved new grant. Enter Name for a new grant. Check Staff user, Permission, Resource type, Scope type, Locations, Categories, and Identity context. Use approved identifiers, not display names, and keep Identity context set to Staff. An Organization scope needs all in both Locations and Categories; a Bounded scope must restrict at least one of those fields.
Preview, save, and verify the scope before continuing
Compare Current effective access, Proposed effective access, additions, removals, and risk messages in Effective access preview. Stop for a self-lockout. If required and approved, select I acknowledge this high-risk access expansion and the affected sessions will be revoked. Select Save record for an edit or Add record for a new grant. Wait for confirmation, select Edit on the saved grant to verify its complete scope, then select Cancel before opening another record or page.
Verify the teammate’s actual task
Have the teammate sign in again using their own account and open the required Studio page and record. Access changes can revoke affected sessions. Confirm both the permitted action and its intended location or category scope.
Result: The saved profile, assignment, and scope match the approved duties, and the teammate can complete the intended Studio task.
Troubleshooting
The preview says this change would lock me out.
Cancel the edit and ask a Studio administrator to arrange another authorized access administrator before changing your own access. Do not remove safeguards or use another person’s account.
The teammate still cannot use the required page after signing in again.
Check the verified Staff user, active profile, active role assignment, template capabilities, and complete scope together. Ask the Studio administrator to approve any correction; contact Orbit support if the confirmed access still fails.
Result
Use Team & access for new invitations. Save access-policy controls such as Require effective-access preview separately with Save changes; that policy save does not replace a staff assignment.
Support
Ask a Studio administrator to approve role or scope changes. Contact Orbit support for a persistent save or access error, including the affected control and visible message without passwords.