> ## Documentation Index
> Fetch the complete documentation index at: https://docs.caplena.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Object-Level Permissions
> Give people access only to the projects or reports they need.
Sometimes you don't want a user to see everything — just one project, one report, or the ability to upload responses without touching anything else. Object-level permissions let you grant access **per project** or **per report**, without changing anyone's role.
## Why object permissions exist
Real scenarios where they help:
* You hire a freelancer to code one survey — you don't want them inside the whole workspace
* A colleague is responsible for uploading new files — but shouldn't edit your topics
* Your manager needs visibility on one project — not all projects
Roles alone can't handle these cases. Object-level permissions fill that gap.
## Project permissions
| Permission | Description |
| ------------------------ | --------------------------------------------------------------------- |
| `Projects View` | View project details and data |
| `Projects Edit` | Modify project settings, TTA columns, and answers |
| `Projects Create` | Create new projects |
| `Projects Download` | Download project data (answers, codes) |
| `Projects Append` | Add new rows/data to existing projects |
| `Projects Inherit` | Use project codebooks as templates for new projects |
| `Projects Permissions` | Manage who has access to projects |
| `View sensitive columns` | See and edit columns marked as sensitive, and include them in exports |
Use **View sensitive columns** to hide PII or confidential fields from most collaborators. Auxiliary columns flagged as sensitive in the [Data Tab](/data-project-management/data-tab-sources/data-tab-overview) only appear for users with this permission — everyone else keeps `Projects View` access without seeing the protected fields.
## Report permissions
| Permission | Description |
| ---------------- | ---------------------------------- |
| `Reports View` | View reports |
| `Reports Edit` | Modify report settings and content |
| `Reports Create` | Create new reports |
## Integration permissions
| Permission | Description |
| --------------------- | ---------------------------------------- |
| `Integrations Use` | Use existing integrations to import data |
| `Integrations Manage` | Create, modify, and delete integrations |
## Administrative permissions
| Permission | Description |
| ------------------------- | -------------------------------------------------------------------------------------- |
| `Team Management` | Manage team members (invite, remove, change roles) |
| `Subscription Management` | Manage billing and subscription settings |
| `Credit Usage` | Perform operations that consume credits (uploading data, AI coding, LLM smart columns) |
## Permission inheritance
Caplena's sharing logic follows a simple hierarchy.
**Project access → Report access** - If a user can access a project, they automatically gain access to all reports in that project, all views in those reports, and any related exports.
**Report access → Report views -** If a user can view a report, they automatically see all its views. However, report access does not grant project access or expose raw data — report users cannot inspect answers unless explicitly granted project permissions.
This lets you safely share reports without exposing sensitive underlying data.
## Ownership rules
**Object owner** — the person who created the project or report always has full control and cannot have permissions removed (only ownership transferred).
**Root organization user** — the master account of your company always sees everything and cannot be restricted or removed.