Ironclad Permissions Overview

How Do Permissions Work in Ironclad?

Ironclad offers robust permissions, equipping you with the ability to control permissions at both a broad and granular level. There are three distinct categories of permissions:

• Group Permissions: Group permissions are for assigning permissions and access to groups of users. For example, you could grant the Finance department access to all procurement workflows.
• Workflow (In-Progress Contract) Actions and Access: While workflow access is granted to users at the group-level with the Workflow Access permission, there is also the ability to set more granular workflow access in Workflow Designer.
• Record (Completed Contract) Actions and Access: Just like workflows, record access is granted to users at the group-level with the Repository and Entities permission. However, more granular access can be granted based on records, record type, and property values.

Each category provides a different set of permissions that when leveraged together, can be used to configure both simple and complex use cases.

Group Permissions

Group permissions serve as the foundational set of permissions for users, while workflow and record specific access provide more granular control over which contracts users can access and actions they can take in Ironclad. 

Groups function both as a collection of users and a bundled set of permissions that ensures that users have appropriate levels of access to contracts and Ironclad features. All Ironclad users are part of one or more groups.

Group permissions are set in Company settings > Groups. Within a group, administrators can grant access to core parts of the Ironclad platform, including the workflows and records on the Dashboard, Workflow Designer, Insights, and more.

User Seat Types

Ironclad assigns a seat type to users based on the total permissions they obtain from their group(s). There are three user seat types in Ironclad:

• Administrator
• Standard
• Requester/Viewer

When you adjust a group’s permissions, it can change the users’ seat type. It’s also important to note that a user who is assigned a Requester seat type because of group permissions can be upgraded to a Standard seat type if they are added as an approver on a workflow they did not launch. To learn more, refer to Manage Admin, Standard, and Requester Users.

On the Groups page, you can identify which seat type is assigned to users that are part of a specific group, according to the permissions set for that group, by referring to the Seat Type column.

If you want to view which groups a user belongs to and how those memberships contribute to their seat type, refer to Manage User Seat Types.

General and Admin Permissions

Group permissions are split into two categories: General and Admin.

By default, users in the Administrators group have access to all workflows, records, and company settings. This cannot be edited.

However, you can create groups with specific admin-level permissions customized to fit your use case. In a group’s permissions, scroll down to the Admin Permissions section. All of the permissions in this section are admin level permissions, and could result in the group’s seat type being changed to Administrator. To learn more about configuring admin level permissions, refer to Configure Group Admin Permissions.

Workflow Permissions

While workflow access is granted to users at the group-level with the Workflow Access permission, administrators can also grant more granular workflow access in Workflow Designer.

Property-Based (Conditional) Access

For additional control over which workflows users can access, Workflow Designer provides the ability to configure conditional access to a workflow based on a specific property’s value.

You can configure conditional workflow access in the Create step of the workflow configuration > Settings.

In the example below, Finance has workflow and record access to Order Forms when the Total Contract Value is greater than or equal to $250,000.

Workflow and Record Access

In Workflow Designer, you can define which users and groups will have access to the workflow and/or resulting record in the Repository. Groups with access will be visible to all participants in the workflow. All participants at the time of archive will also be given access to the resulting record. Users without Repository access will not be able to view the record, but this can be adjusted through Group permissions.

Review Permissions

In the Review step of Workflow Designer, you can control which users and groups can download and share workflow documents.

Additionally, in an active workflow, users can add participants ad hoc via @mentions in the Activity Feed to loop in necessary teammates without slowing down the contract process.

Record Permissions

Just like with workflows, record access is granted to users at the group-level with the Repository and Entities permission. However, more granular access can be granted:

1. Per-Record Permissions: Administrators can grant groups access to certain records. For example, there may be a set of NDAs that the Sales Team should have access to, and a separate set of NDAs that the Partnerships Team should have access to. Using per-record permissions, the administrator can grant each group the appropriate access.
2. Record Type Permissions: Administrators can grant groups access to all records of a certain type. For example, they may grant view-only access to your People Operations Team for Offer Letters. They may also grant edit access to the Legal Team for all types of contracts.
3. Property Value: For additional control over which records users can access, Workflow Designer provides the ability to configure conditional access to a record based on a specific property’s value. You can configure conditional record access in the Create step of the workflow configuration > Settings.