Permissions: Enterprise-Grade Access Control, Without the Enterprise-Grade Pain
Paminga now supports enterprise-grade Permissions — Teams, Roles, and category-based access control across every meaningful surface in the platform.
If you've ever asked "can the content team please not delete the production segments," this release is for you.
The model is the one you'd build if you were building it from scratch today — Teams, Roles, additive permissions, scoped down per category. No 47-page admin guide required.
How the Pieces Fit Together
Three concepts, in order of how you'll actually use them:
- Permissions — the granular capabilities (create Custom Fields, publish Emails, export Contact data, share Finder folders, etc.) organized into categories
- Roles — bundles of Permissions that you assign to users. Team Roles are scoped to a Team; Global Roles are platform-wide.
- Teams — groups of users, each with their own Roles. Users can belong to multiple Teams with different Roles in each.
Permissions are additive. A user inherits every permission from every role they're assigned. No subtractive denies, no exception lists.
The Six Permission Categories
You configure permissions one category at a time. Each category lines up with a real piece of the platform.
Administrative
Create any number of administrative Roles and grant exactly the level of access desired. Or sprinkle a basic admin permission — like creating Custom Fields — onto a non-admin role when one team member needs it.
Approvals
When Approvals are enabled, this category controls two things:
- Manage — who can configure approval settings (designate approvers, enable/disable)
- Publish Without Approval — granted independently per asset type (Forms, Emails, Landing Pages, CTAs, Brand Kits)
Senior team members or fast-moving roles can skip the review process. Everyone else lives by the workflow.
Assets
Precise control over who can work with Emails, Forms, Landing Pages, CTAs, and Brand Kits — create, edit, publish, delete, you choose.
Automations
Drip Series, Branching Workflows, and Action Sets. The motions that move contacts through your funnel get their own dedicated permission category.
Data Management
Protect data from export, update, or even being viewed — scoped by Team and Role.
If your compliance team has ever asked "can the marketing intern accidentally export every contact in the database?" — this is the answer.
Finder
Finder permissions, plus a powerful add-on: folder-level sharing. Right-click any Folder in the Finder and grant access to specific teams or users as Editor or Viewer.
That last bit is the killer feature. Big organizations can set up Folders per region, per business unit, per agency, per anything — and share each one with the right people without touching the platform-wide Role config.
Teams: Use Them, or Don't
You can choose to leverage Teams as part of your permissions strategy:
- Create as many Teams as you need
- Add as many users to each Team as you need
- Assign as many Roles per Team as you need
Or skip Teams entirely and use Global Roles for a simpler structure. The system flexes to your org chart, not the other way around.
Every Paminga instance ships with a default Team called "Marketing" and four sensible default Team Roles:
- Marketing Administrator
- Marketing Manager
- Content Creator
- Content Publisher
Plus one default Global Role — Platform Administrators — which your initial user inherits with full access.
Why This Matters
Most MAPs treat permissions as a checkbox feature: "yes, we have roles." In practice that usually means three roles, no team scoping, and no way to give one agency access to one Folder without giving them access to everything.
❌ Don't ship sensitive marketing operations on a permissions model designed for 5-person teams.
✅ Do model your real-world responsibilities — Teams, Roles, Folder access — and let Paminga enforce them.
Get Started
- Open Account Settings → Permissions and walk through the six categories
- Decide whether you want to use Teams (you probably do) and create them
- Build your Roles — start from the defaults and adjust
- Right-click Folders in the Finder to share specific scopes with specific people
Read the Permissions docs to dig in.
