Which Permission Do I Need?
A lookup table from what you want to do to the permission your role must grant. For the model behind these permissions, see the Permissions Overview; to change a role, see Managing Roles and Permissions.
The short version
| Permission | Grants |
|---|---|
| Read | Opening and viewing anything |
| Create new | Making a new object — including duplicating, importing, and generating a template |
| Edit/Update | Changing an existing object or a draft |
| Approve | Publishing, releasing, starting an approval workflow, approving, and rejecting |
| Download | Exporting, downloading a file, generating a PDF |
| Delete | Removing an object |
The tables below tell you which permission an action needs. They do not describe a per-module grant: a role holding Edit can edit everywhere in CertHub. See Permissions apply organization-wide.
Five rules that catch people out
- Publishing is Approve, not Edit. Releasing a new version of a SOP, document, template, product, product family, knowledge unit, or submission requires Approve. An author with Edit and Create can prepare the version but not release it.
- Rejecting is also Approve. Turning an approval step down uses the same permission as approving it.
- Exporting is Download, not Read. CSV export, EUDAMED XML, folder export, and every generated PDF require Download, even for content you can already read on screen.
- Duplicating and importing are Create. Copying an existing object makes a new one, so it needs Create new rather than Edit.
- Starting an approval workflow is Approve, not Create. Starting one is an approver action, and CertHub also refuses to start it if any reviewer you name lacks Approve — see Approvals below.
Products, product families and guidance
| Task | Permission |
|---|---|
| View products and product families, search, use the classifier, view guidance and risk analysis | Read |
| Create a product or product family; duplicate a product; generate guidance | Create new |
| Change product or product family metadata; commit a revision; update a task state | Edit/Update |
| Publish a product or product family revision | Approve |
| Export product data as CSV; download EUDAMED XML | Download |
| Delete a product or product family | Delete |
Knowledge topics, knowledge units and schemas
| Task | Permission |
|---|---|
| View knowledge topics, knowledge units, their schemas and schema libraries | Read |
| Create or duplicate a knowledge topic or unit; create a schema or schema library; import schemas or units | Create new |
| Edit a knowledge topic, knowledge unit or schema | Edit/Update |
| Publish a knowledge unit or a knowledge unit schema | Approve |
| Export knowledge units or schemas | Download |
| Delete a knowledge topic, knowledge unit, schema or library | Delete |
Processes (SOPs), work instructions and forms
| Task | Permission |
|---|---|
| View SOPs, work instructions, forms, categories and version history | Read |
| Create or duplicate a SOP, work instruction, form or category | Create new |
| Start a SOP draft | Create new or Edit/Update |
| Edit a draft; commit a draft | Edit/Update |
| Publish a SOP draft | Approve |
| Download a SOP or work instruction as PDF | Download |
| Delete a SOP, work instruction, form, category or draft | Delete |
Direct edits to a released SOP are rejected by CertHub regardless of permissions. Every change goes through a draft, and releasing that draft needs Approve. A role with Edit but not Approve can therefore prepare SOP changes but never release them — which is the intended separation of authoring from approval. See Approval and versioning.
QM lists, records and global elements
| Task | Permission |
|---|---|
| View QM lists, categories, records and global elements | Read |
| Create a QM list or category; import global elements; create filter tags and group IDs | Create new |
| Create a record; create records in bulk; batch-duplicate records | Create new or Edit/Update |
| Edit a QM list, category, record or global element | Edit/Update |
| Export global elements; render an audit report | Download |
| Delete records (single, multiple or by context), lists, categories, filter tags or group IDs | Delete |
Documents, templates and folders
| Task | Permission |
|---|---|
| View documents, templates, folders and revision history | Read |
| Create a document, template or folder; duplicate; import; create a template from a file | Create new |
| Start a document or template draft | Create new or Edit/Update |
| Edit a document or template draft; co-edit a document live with others; summarize a document | Edit/Update |
| Lock or unlock a document or template revision | Edit/Update or Approve |
| Publish a document or template revision | Approve |
| Export documents, templates or folders; generate a PDF | Download |
| Delete a document, template or folder | Delete |
Submissions, submission templates and jurisdictions
| Task | Permission |
|---|---|
| View submissions, submission templates and jurisdictions | Read |
| Create or duplicate a submission or submission template; create a jurisdiction | Create new |
| Edit a submission, submission template or jurisdiction | Edit/Update |
| Publish a submission or submission template revision | Approve |
| Export a submission or template; download a rendered result | Download |
| Delete a submission, submission template or jurisdiction | Delete |
Approvals
| Task | Permission |
|---|---|
| See your pending approvals and any approval process | Read |
| Start an approval workflow on an object | Approve |
| Approve a step, reject a step, retry a failed step | Approve |
| Cancel an approval process | Delete |
If you name a reviewer whose roles do not grant Approve, CertHub refuses to start the workflow and names the reviewers concerned, rather than letting the process stall later at a step nobody can complete. If you see that message, either give those users a role that grants Approve or route the step elsewhere.
Tracer
| Task | Permission |
|---|---|
| View traces and nodes; start matching a SOP or global elements against existing traces | Read |
| Create a trace link, trace in batch, copy traces | Create new, Edit/Update or Approve |
| Submit trace or matching decisions; change a trace link | Create new or Edit/Update |
| Update node versions | Create new, Edit/Update or Approve |
| Delete a trace or a node | Delete |
File manager
| Task | Permission |
|---|---|
| Browse files and images, view file versions | Read |
| Upload a file or image; change file tags | Create new or Edit/Update |
| Download a file or image | Download |
| Delete a file | Delete |
AI assistants and generation
| Task | Permission |
|---|---|
| Chat with an assistant, open a session, review a proposed change | Read |
| Keep or revert a change an assistant made to a document | Read |
| Create or change an assistant definition | Read |
| Generate a template; extract metadata or a process model; start, stop or resume an agent run | Create new |
| Generate knowledge topic content from files or text; generate a checklist from text or a file; run matching, bulk matching or checklist matching | Edit/Update |
| Let the document writer change a document | Edit/Update |
| Delete an agent session or an assistant definition | Delete |
When an assistant writes to a document, the change is applied straight away so you can see it. You then keep it or revert it, which needs only Read on the document.
Reminders
| Task | Permission |
|---|---|
| View reminders | Read |
| Create a reminder | Create new |
| Change a reminder | Edit/Update |
| Delete a reminder | Delete |
Roles and users
Creating roles, changing permissions, and assigning users are not covered by any of the six permissions. They require the separate Can manage roles setting, which is fixed when your organization is set up and normally held only by Admin. See Role administration.
Building a role for a job
Three common shapes, as a starting point:
| Function | Permissions to grant |
|---|---|
| Read-only auditor or observer | Read, and Download if they need to take evidence away |
| Author — prepares content, does not release it or start approvals | Read, Create new, Edit/Update |
| Approver — reviews and releases, does not author | Read, Approve, and usually Download |
Grant Delete only where a function genuinely needs it. Superseding a document through versioning is the auditable equivalent and keeps the history.
When something is blocked
| What you see | What it means |
|---|---|
| "No access assigned. Contact your administrator" | You hold no role, or none of your roles grants Read |
| "You do not have write access" | The action needed Edit, Create, Approve, Download or Delete, and none of your roles grants it |
| A greyed-out button | The interface reflects your permissions; find the action in the tables above and check that permission on your roles |
| A message naming reviewers without approve permission | You are starting an approval workflow and a named reviewer's roles lack Approve |
| 403 Forbidden from the API | The same rules, applied to the user who created the API key — see API Permissions |
Permission changes take effect within about a minute. If you have just been given a role and still see a block, reload the page before investigating further.