> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getnovaplan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Roles, resource access, and field-level masking of sensitive data.

Permissions control who can see and do what in Novaplan, down to individual sensitive fields, so
the right people see salaries and comp while the rest of the team sees everything else. Access is
enforced at the data layer, so it cannot be bypassed by exporting, by Nova, or by a custom report.

## How access works

* **Roles** group people by what they should be able to do, from full admin to read-only.
* **Resource access** governs which areas a role can reach (planning, reporting, admin).
* **Field-level masking** hides sensitive values (salaries, comp, customer-linked amounts) from
  roles that should not see them, while still letting them use the rest of the screen.

## Roles and capabilities

Novaplan ships with a set of standard roles. The matrix below describes what each can broadly
see and do. Treat it as the default shape; specific deployments can grant narrower or broader
access per role.

| Capability                               | Super admin | Admin | Budget owner | Executive | Analyst | Reports viewer | Revenue operator |
| ---------------------------------------- | ----------- | ----- | ------------ | --------- | ------- | -------------- | ---------------- |
| Manage integrations and connectors       | Yes         | Yes   | No           | No        | No      | No             | No               |
| Manage dimensions, GL mapping            | Yes         | Yes   | No           | No        | No      | No             | No               |
| Manage roles and permissions             | Yes         | Yes   | No           | No        | No      | No             | No               |
| Edit plans (headcount, revenue, expense) | Yes         | Yes   | Yes          | No        | No      | No             | Limited          |
| Lock and snapshot a version              | Yes         | Yes   | Yes          | No        | No      | No             | No               |
| Manage revenue pipeline and contracts    | Yes         | Yes   | Limited      | No        | No      | No             | Yes              |
| View reports and dashboards              | Yes         | Yes   | Yes          | Yes       | Yes     | Yes            | Yes              |
| See sensitive amounts (salary, comp)     | Yes         | Yes   | Yes          | Limited   | Masked  | Masked         | Masked           |
| Ask Nova                                 | Yes         | Yes   | Yes          | Yes       | Yes     | Limited        | Yes              |
| View audit trail                         | Yes         | Yes   | Limited      | No        | No      | No             | No               |

<Note>
  "Limited" cells reflect access that is commonly scoped per deployment rather than guaranteed.
  Confirm the exact grants for your tenant before relying on a borderline capability.
</Note>

## Masking in practice

When a value is masked for someone's role, they see a clear "hidden for your role" state, not a
misleading zero. This holds everywhere: tables, KPIs, reports, Nova answers, and exports.
Sensitive fields are classified centrally (for example salary and comp, GL amounts, and
customer-linked revenue amounts), and every screen resolves the viewer's mask against that
classification, so the same field is masked consistently no matter where it appears.

## Common questions

<AccordionGroup>
  <Accordion title="Can a masked user uncover values by exporting?" icon="user-shield">
    No. Masking is applied at the data layer before results leave it, so an export, a Nova answer,
    and a custom report all reflect the viewer's permissions.
  </Accordion>

  <Accordion title="Why does a KPI show 'hidden for your role' instead of a number?" icon="user-shield">
    The underlying figure is a sensitive field your role is masked on. The deliberate "hidden"
    state distinguishes a restricted value from a genuine zero.
  </Accordion>
</AccordionGroup>

## Troubleshooting

* **A user cannot reach a page they should:** check the role's resource access, then any
  deployment-specific grants.
* **A value is masked for someone who needs it:** their role lacks the field group for that
  sensitive field. Adjust the role or the user's grant.
* **An admin action is denied:** management of integrations, dimensions, GL mapping, and
  permissions is admin-only by design.