Roles & Permissions in Span

Last updated: October 27, 2026

Span controls what each person can see and do with permission groups: role-based access control with built-in groups and groups you create. Each group decides who belongs, which permissions they get, and whose data those permissions cover.

Why it matters

For admins: you can match access to your org chart, so managers see their own people and specialists such as finance or survey owners get only the tools they need.
For everyone else: when someone can't see a page or a person, the cause is almost always a missing permission or a missing reporting line. This article shows where to look.

How it works

Four kinds of permission

Global: organization-wide abilities, such as managing integrations or members.
Team: aggregated data for teams.
People: data about individual people.
Self: what group members see about themselves.

Who belongs to a group

All People: everyone in your organization.
People that meet specific criteria: rules on roster fields such as job title, job family, and level, with AND INCLUDE to add named people. Membership updates as your roster changes.
Individuals: people you pick by name. The picker shows each person's email under their name.

Whose data a group can see

People Permissions option	Covers
None	No access to any other individual's data.
Reports	Direct and indirect reports only.
Reports & Team Members	Members of the teams they're on and the sub-teams below, plus direct and indirect reports.
Specific Teams	People on the teams you select.
All People	Everyone.

Teams Permissions option	Covers
None	No aggregated data for any team.
Affiliated Teams	The teams they're on and the sub-teams below them.
Specific Teams	The teams you select.
All Teams	Every team.

Built-in groups

New organizations start with these groups. Except for Owners and Admins, you can edit them, so yours may differ.

Group	Who's in it	What it grants
Owners	Named people, set up with Span	Every permission, including Manage Permission Groups and cost data.
Admins	Named people, set up with Span	Every permission except Manage Permission Groups, Manage Cost Estimates, and Investment Cost Estimates.
Integration Admins	Named people	Manage Integrations.
Survey Admins	Named people	Manage Surveys.
Finance Admins	Named people	Manage Investment, Manage Cost Estimates, Manage Cost Capitalization, plus Investment, Investment Cost Estimates, and AI Spend for all teams.
Managers	Automatic: anyone with direct reports	Benchmarking and Industry Benchmarking; team data for all teams; Manage Team Targets for their own teams; people data for Reports & Team Members; their own data; Manage Custom Reports and Manage Custom Dashboards.
Team Leads	Named people	Benchmarking; team data for all teams; people data for Reports & Team Members; their own data.
Team Members	Automatic: everyone	Team data for the teams they're on; their own data.

Owners and Admins are managed by Span: their permissions can't be changed ("This role's permissions are managed by Span and cannot be modified."), and they can't be deleted. Only Owners can manage permission groups.

Global permissions

Permission	What it allows	Settings pages it opens
Member Management	Add, edit, and remove all members, and edit team names and members.	People Management, Team Management, Agent Management
Manage Integrations	Add, edit, and remove integrations.	Integrations, Traces, Single Sign-On, SCIM Setup
Manage Permission Groups	Add, edit, and remove permission groups.	Permission Groups, and the Permissions tab on a person's profile
Metrics Configuration	The VCS ignore list, PR size, and other metric settings.	Metrics, Org Calendar, Brag Sheets, Src
Manage Surveys	View, create, edit, and delete surveys.
Manage Investment	Investment areas, workstreams, and maintenance data.	Investment
Manage Cost Estimates	Salary data used for investment cost reports.
Manage Cost Capitalization	Cost capitalization reports and overrides.	DevFinOps
Benchmarking / Industry Benchmarking	Compare teams and people against job levels, or against the industry average.
Manage Custom Reports / Manage Custom Dashboards	Create, edit, and delete custom reports and dashboards.
Use Src / Manage Src	Use Src chat, or manage its configuration and access.
Manage Playbooks	Create, edit, and delete playbooks.
Manage Service Accounts	Create, edit, and delete service accounts.	Service Accounts
Manage Connected Apps	View and revoke members' connected app (OAuth) authorizations.	Connected Apps (Organization)
Manage Audit Log	The audit log of changes in Span.	Audit Log
Manage Directory Sync	Review and apply directory syncs.	Directory Sync (once Span sets up a roster source)

People and team permissions

People Permissions: Personal Details (job level and title), Investment, Onboarding Report, Issue Tracking, Pull Requests, Review Themes, Time, Activity Summaries & Brag Sheets, Activity Log, AI Spend, Agent Trace Data, Manage Traces, Agent Trace Contents, and Agent Trace Reporting.
Teams Permissions: Manage Team Settings, Investment, Investment Cost Estimates, Issue Tracking, Pull Requests, Review Themes, Time, Top Meeting Investment Report, Activity Summaries, Manage Team Digests, View Team Targets Status, Manage Team Targets, AI Spend, Agent Trace Data, and Agent Trace Reporting.

The four agent trace permissions work differently from the rest. See Agent Trace permissions.

Setup

For new organizations

Name your Owners and Admins. Span sets up these two groups. Tell your Span contact who belongs in each. Make sure at least one Owner can manage permission groups going forward.
Review the built-in groups in Settings → Permission Groups (under Organization). Most organizations use Managers, Team Leads, and Team Members as they are.
Check automatic membership. Managers fills itself from reporting lines in your roster, and Team Members includes everyone. Team Leads needs named people or your own criteria.

Create a permission group

Go to Settings → Permission Groups and click Add group.
Setup: enter a name and choose All People, People that meet specific criteria, or Individuals. The member count shows who matches.
Global Permissions: pick organization-wide permissions.
Teams Permissions: choose which teams, then what the group can see for them.
People Permissions: choose whose individual data, then what the group can see about them.
Self Permissions: choose what members see about themselves.
Review your permission group and click Finish. When editing an existing group, Save & Exit saves from any step.

Give one person a group

In Settings → People Management, click the person's Permission groups cell, or open Edit on their row and use the Permission groups section. You need Manage Permission Groups.
Two people with the same name? Search People Management by email, and check the email column before you change anything. In the Individuals picker, the email shows under each name.
Groups that fill themselves can't be changed per person. Span shows "Membership in this group comes from a rule." or "Everyone in the organization belongs to this group."
To see everything a person can access, open their profile and select the Permissions tab. It lists their permission groups and a permission matrix.

Things to know

Member Management is organization-wide. There is no team-scoped version. Anyone with it can add, edit, and remove any member, and edit any team's name and members. People Management and Team Management both need it.
Manage Team Settings is narrower. It opens Team Settings for the chosen teams, including sprint tracking. Setting up a team's Slack digest also needs Manage Team Digests or Manage Team Targets for that team. Changing a team's name or members still needs Member Management.
Managers come from reporting lines. If a manager can't see their people, check that each report's Manager field points to them. A team edit takes about 30 minutes to show in reports.
Managers don't see agent traces by default. The built-in Managers group has no agent trace permissions. Add a group with Agent Trace Data scoped to Reports to show trace facts such as cost and model. Prompts and transcripts stay private to their author unless Span switches your organization to permission-based trace visibility.
Users can check their own access. When a report is limited, Span shows "You are seeing a limited set of data based on your permissions." Learn more opens My Permissions. To get more access, ask an Owner.
Admins can't manage permission groups. Only Owners can. Admins also can't see or edit salary-based cost estimates.
Worked example: Priya has 6 direct reports. Two of them lead teams of 4 people each. With Reports, Priya sees 14 people (6 direct plus 8 indirect). With Reports & Team Members, she also sees anyone on the teams she belongs to and their sub-teams, even if they don't report to her.

Need help?

Contact your Span account team or reach out to support@span.app.