Roles & permissions
Org roles, what each role can access, and how platform feature flags interact with permissions.
InsightHire uses organization-scoped roles. Permissions are enforced in the API (insighthire-api) on every tRPC procedure — the UI hides unavailable actions, but the server is authoritative.
Standard org roles
| Role | Positions | Candidates | Review queue | Settings | Billing |
|---|---|---|---|---|---|
| Owner | Full | Full | Full | Full | Full |
| Admin | Full | Full | Full | Full | View |
| Recruiter | Create/edit assigned | Full | Full | Limited | — |
| Hiring Manager | View assigned | View assigned | View assigned | — | — |
| Member | View | View | — | Account only | — |
Hiring Manager vs Recruiter
- Recruiters own pipeline motion: invites, stage changes, rejections, messaging.
- Hiring Managers consume evidence: watch videos, leave feedback, complete scorecards. They cannot change org-wide settings unless also Admin.
Position-level access
Positions can restrict visibility to:
- All org recruiters (default)
- Explicit hiring team (recruiter + named hiring managers)
- Private drafts (admin/recruiter only until published)
When job governance is enabled, requisition owners and approvers gain additional read access during approval — see Job governance.
Feature flags vs roles
Platform admins enable capabilities per tenant in InsightHire Admin → Integrations & Features. A recruiter may have permission to use custom pipelines, but the Custom Pipelines flag must be on for the org or the settings pages and kanban board won't appear.
Flags that commonly gate UI:
| Flag slug | Unlocks |
|---|---|
custom_fields | Settings → Custom Fields, values on positions |
job_governance | Requisitions, approvals, intake forms, templates |
custom_pipelines | Per-job stages, automations, task inbox |
structured_interviews | Interview kits, scorecards, feedback enforcement |
custom_reports | Report builder, dashboards, scheduled email |
dei_compliance | Demographics, EEOC export, blind review, fraud queue |
candidate_surveys | NPS surveys on stage change |
culture_fit_scoring | Culture profiles and culture-weighted scoring |
talent_network | Talent network CRM surfaces |
Contact InsightHire support or your CSM to enable flags in production.
Invitations & SSO
Team invites: Settings → Team → Invite. WorkOS AuthKit handles SSO when configured for your domain. Invited users inherit the role selected at invite time; admins can change roles later.