> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> Four roles (viewer, org_admin_viewer, editor, admin), capability matrix, and app access modes.

HASP apps have four roles: `viewer`, `org_admin_viewer`, `editor`, and `admin`. The current user's role is returned by `sdk.getBootstrap()`.

## Role Capabilities

| Action              | viewer | org\_admin\_viewer | editor | admin |
| ------------------- | ------ | ------------------ | ------ | ----- |
| Read records        | Yes    | Yes                | Yes    | Yes   |
| Create records      | No     | No                 | Yes    | Yes   |
| Update records      | No     | No                 | Yes    | Yes   |
| Delete records      | No     | No                 | Yes    | Yes   |
| Manage app settings | No     | No                 | No     | Yes   |

## The `org_admin_viewer` Role

Org admins and owners have baseline read access to every app in their organization — including apps configured as `private` or `invite_only` where they haven't been invited as a member. When an org admin visits such an app, `sdk.getBootstrap().role` returns `'org_admin_viewer'`.

This role:

* Has the same permissions as `viewer` (read-only)
* Signals that the user is seeing the app via baseline admin visibility, not via per-app membership
* Does NOT grant write access

If your app uses a role allowlist, add `'org_admin_viewer'` to your read-allow set:

```javascript theme={null}
const ALLOWED_READ_ROLES = ['viewer', 'org_admin_viewer', 'editor', 'admin'];
const ALLOWED_WRITE_ROLES = ['editor', 'admin'];
```

## Getting the Current Role

```javascript theme={null}
const bootstrap = await sdk.getBootstrap();
// bootstrap.role — 'viewer' | 'org_admin_viewer' | 'editor' | 'admin'
```

## Role-Based UI

```javascript theme={null}
const bootstrap = await sdk.getBootstrap();
const canEdit = ['editor', 'admin'].includes(bootstrap.role);

if (canEdit) {
  document.getElementById('create-btn').style.display = 'block';
}
```

See [Role-Based UI guide](/app-builder/guides/role-based-ui) for more patterns.

## App Access Modes

Each app has an access mode that determines the default role for org members:

| Mode                   | Description                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------- |
| `private`              | Only members with an explicit grant. Org admins retain baseline read access.           |
| `invite_only`          | Only members with an explicit grant. Org admins retain baseline read access.           |
| `org_wide`             | Every org member, defaulting to `viewer`.                                              |
| `org_wide_plus_guests` | Every org member plus guests from allowed domains, defaulting to `viewer`.             |
| `public`               | Anonymous visitors may view the published app. An app in this mode can never hold PHI. |

Org admins' baseline visibility is a governance right, not an app-level permission. It cannot be revoked at the app level — it applies to `private` and `invite_only` apps via the `org_admin_viewer` role above.

<Warning>
  `public` apps are readable by **anonymous, unauthenticated visitors** once published. HASP structurally prevents such an app from holding PHI: an app whose effective PHI mode would allow PHI cannot be saved in `public` mode, and the anonymous write path fails closed independently. Authenticated non-members land on `viewer`; org owners and admins land on `admin`.
</Warning>

Access mode is configured by org admins per-app in the HASP dashboard.