Managing Access

Roles ensure users only access the features necessary for their job.

​

Create roles

1. In Spott, go to Settings.
2. In the Admin section, click Security.

Under Workspace Roles you can:

• Open existing roles
• Create new ones with the New role button

Click a role to open it. For each role, use the toggles to enable the permissions that role should have, grouped per area (records, settings, analytics, exports, and more). For example, you may want to grant team leads access to workspace settings (to create new fields) while restricting this for regular members, or control who can view, manage, and export Analytics Reports.

​

Permissions people go looking for

Most permissions do what their name says. These come up often, because the action they gate simply disappears or fails rather than explaining itself:

• Use the MCP server (under Integration restrictions). Connecting Spott to Claude or ChatGPT is its own permission, separate from the record access the connector inherits. Without it a user completes the sign-in normally and then every request comes back as MCP_ACCESS_DENIED. See Spott MCP.
• Delete Job. Without it, the delete option on a job is greyed out rather than hidden, so it looks like a fault.
• Restrict job access. Ticking Restrict visibility on a job is its own permission. Without it a user can still work on jobs but cannot restrict one, or lift a restriction. Who can then see a restricted job is set by the workspace’s visibility policy, on this same Security page. See job visibility.
• Enrich People (under Enrich restrictions). Switching it off for a role stops those users spending credits on enrichment at all. To let them enrich but cap how much, set a monthly credit limit per user instead. See profile enrichment.
• Merge People, Merge Company, and Merge Job (under Merge restrictions). Merging needs its own permission per record type: Merge People covers candidates and contacts together. Without it the merge fails at the last step.
• Edit Placement (under Edit restrictions). Correcting a placement’s fee, dates, or type needs it. Consultants without it can still open a placement. See placements.
• Company hierarchies. Creating and editing a company hierarchy is its own permission, so you can let a team read a client group’s structure without letting them reorganize it. On a large account the tree is shared reference data, and one person reparenting an entity changes what everyone else sees.
• Manage Templates. Managing the workspace’s templates and prompts is its own permission, split out of Manage Workspace so that the person who owns how your emails and notes read does not also need the run of every workspace setting.
• Manage Notes. Writing notes is its own permission. A role without it can still read every note it has access to, but cannot create, edit, or delete notes, its own included. Use it for roles that should follow what is happening on a record without adding to it. Every existing role was given the permission when it was introduced, so nothing changed until an admin switched it off. See notes.
• Delete Interaction. Removing an individual synced email, or another single interaction, from Spott is its own permission. The interaction disappears from Spott for everyone, so it is the tool for a private email that was synced by mistake. The connected source is not touched: the email stays in the mailbox it came from.

Two things only an admin can do, whatever you grant. Seeing every user in the workspace is admin-only: for a manager who needs other teams’ figures without full admin, grant Manage Analytic Reports, which opens the team and user filters on the Dashboard and in reports. And you cannot remove your own role, so a second admin has to make that change for you.

​

Add a user

1. In Spott, go to Settings.
2. In the Admin section, click Users.
3. Click Invite User, enter the person’s email address, and give them a role.

They receive an invite link, create their password, and are in. From then on they can also sign in with Microsoft or Google. See personal preferences.

​

Invite several people at once

The Emails field takes up to 10 addresses per invite. Paste them separated by commas or on separate lines, or press Enter after each one. Semicolons and spaces do not split addresses. Everyone in one invite gets the same roles, so invite a new desk of consultants together and the team leads separately. An address that is not valid, or is in the field twice, is refused as you enter it. When some of the people cannot be invited, the others still are, and Spott lists the rest under “Some invitations could not be sent” with the reason, for example that the person is already a member, already has a pending invitation, belongs to another workspace, or is a Company Portal contact. A pending invitation takes a seat straight away. If an invite needs more seats than you have left, nobody in it is invited and Spott shows “Over seat limit”. Check your seats under Billing before you invite a large group.

​

Assign roles to users

1. In Spott, go to Settings.
2. In the Admin section, click Users.

Use the role dropdown next to a user to assign them a role, which automatically grants the matching permissions. When a user holds more than one role, their permissions combine: the roles add up rather than restrict each other.

​

Set a monthly credit limit per user

Credits come from one balance the whole workspace shares, so a single user enriching a long list can spend what the rest of the team was counting on. A monthly credit limit caps what each user can spend.

1. Go to Settings → Users.
2. On the user’s row, choose Edit spend limit.
3. Enter a Monthly credit spend limit, or leave it empty for no limit.

A user without a limit is unlimited, which is how everyone starts. Setting limits needs the permission to manage billing, which admins have. The limit counts the credits a user spends themselves: enriching a profile or a selection, enrichment run by their outreach campaigns, and importing an HTML template into a marketing campaign. Automations and auto-updating profiles do not count toward anyone’s limit; they draw on the workspace balance only. The limit covers a calendar month and resets on the 1st at midnight UTC. To give someone room before then, use Reset this month’s usage. You cannot set a limit lower than what the user has already spent this month without resetting their usage at the same time. When a user reaches their limit, credit-using actions are blocked with “Your monthly credit spend limit has been reached. Contact an administrator about your allowance.” There is no warning beforehand and no message to admins. A bulk action is all or nothing: if the whole selection does not fit in what is left, none of it runs.

​

Multi-factor authentication

On the Security page you can require multi-factor authentication for your whole workspace. Users then add an authenticator app to their own profile the next time they sign in.