PersonalPremiumFamilyTeamBusinessEnterprise
Access levels & permissions
The five sharing access levels (OWNER, MANAGER, EDITOR, VIEWER, LIMITED), the per-vault permission flags they map to, and the rules that keep sharing safe.
When you share a vault or item, you grant an access level. Each level maps to a set of permission flags the app enforces on every action.
The five access levels#
| Level | Can view | Can edit items | Can manage members | Can change settings | Notes |
|---|---|---|---|---|---|
| OWNER | ✓ | ✓ | ✓ | ✓ | The creator. Can delete the vault and rotate keys. Never assignable via sharing. |
| MANAGER | ✓ | ✓ | ✓ | ✓ | Add/remove members and edit settings (team contexts). |
| EDITOR | ✓ | ✓ | — | — | Create, edit, and delete items. |
| VIEWER | ✓ | — | — | — | Read items and copy values; no changes. |
| LIMITED | partial | — | — | — | Autofill-only; plaintext stays hidden. |
OWNER is never granted by sharing
The maximum level you can assign when sharing is EDITOR. OWNER belongs to the creator alone. This is a hard rule across the platform.
Permission flags#
Access levels are shorthand for these underlying flags, which the client and server both check:
canViewItems— open and decrypt itemscanCreateItems— add new itemscanManageMembers— invite, change levels, or revoke memberscanAccessSettings— change vault name, encryption, and policies
How levels apply#
- Vault shares grant a level for every item in the vault.
- Item shares grant a level for a single item.
- Secure links are a special read path — see Secure links.
In organizations, levels combine with roles (organization- and team-scoped permissions) and may be subject to shared-vault policies and an approval queue.
Related#
Was this page helpful?