Roles and permissions in a workspace

PostFast uses three roles, each with a default set of permissions. Admins can override individual permissions per user on top of the role template — so a role is a starting point, not a hard boundary.

The three roles

• Admin — full control of a workspace: billing, API keys, deleting the workspace, managing members, everything. Admin is assigned automatically to whoever creates the workspace. You can't invite a new user directly as Admin from the Users tab; that role only exists via workspace creation.
• Editor — full day-to-day operational access: create, edit, delete, schedule, and approve posts; internal team comments; connect social accounts; generate public connect links; manage tags.
• Client — built for external collaborators (typically agency clients reviewing scheduled content). Clients can view posts and post regular comments, and by default they can also approve posts (the agency→client review pattern that gave this role its name). What Clients cannot do by default: see or post internal team comments, edit workspace settings, or manage accounts/tags.

Exact per-role defaults are visible in the Edit Permissions dialog — that's the canonical source of truth, since overrides can make any two users with the same role behave differently.

Edit a user's permissions

Admins can fine-tune permissions per user beyond the role defaults.

1. From Settings → Workspace → Users, click the shield icon next to a non-Admin user (or pick Edit Permissions from the three-dot dropdown on mobile).
2. The dialog groups all permissions into five categories:
   • Posts — Create, Edit, Delete, Schedule, Approve posts
   • Comments — Internal comments (Admin and Editor only; not granted to Client by default)
   • Accounts — Connect accounts, Generate connect links
   • Filter Tags — Create / Update / Delete tags
   • Workspace — Workspace settings, Manage members, API keys (admin only), Delete workspace (admin only)
3. Toggle any permission. An Override badge appears next to permissions that differ from the role's default — handy for spotting which access has been customized.
4. Admin-only permissions (API keys, Delete workspace) are locked with a lock icon and can't be granted to non-Admin users at all.
5. Save is only enabled if something actually changed.

Approval workflow

Posts move through a status flow. Only posts in the Approved state will publish when their scheduled time arrives — anything else is held back.

Anyone with the Approve posts permission can approve. By default, all three roles have this permission — so the same person who schedules a post can usually approve it. The Client approves pattern is common for agency setups: the agency drafts and schedules, the client reviews and approves.

To take approval rights away from a specific user, open Edit Permissions and toggle Approve posts off. The Override badge will show the permission has been customized away from the role default.

Related

• Invite team members to a workspace
• Change or cancel your plan — per-plan user limits and how billing spans workspaces