Collaboration · Brand Builder field guide
Give the architect one project—not your entire brand workspace.
A consultant needs the drawings for one restaurant. Your choices should not be “make them an admin” or “email the files outside the system.” Role-based project access gives each person the smallest useful view of the work.
The mess this fixes
Where this breaks in real life
All-or-nothing access forces bad compromises. Give too much and a partner can see unrelated locations or controls. Give nothing and the team falls back to attachments, private links, and files nobody can govern after they are sent.
Project access
Access for North Loop #087
- Jordan Lee
- Brand owner
- Studio North
- Project-only
- Former vendor
- Access removed
The fix
What to change
Start with the person’s actual job. If they only review one location, grant that project. If they manage the brand, use the appropriate brand role. Expand access only when the work requires it, and remove the temptation to solve every invitation with admin rights.
Do it in this order
- 01
Name what they need to do
Decide whether the person owns the brand, manages work, reviews files, or needs one project.
- 02
Grant the smallest access
Give the architect the selected restaurant instead of the whole brand workspace.
- 03
Remove it when the job ends
Change or revoke access when the project or the person's responsibility changes.
What should be easier afterward
- The architect can review one restaurant without seeing the other 40
- A viewer cannot use owner or administrator controls
- Client access never grants global Platform Admin
Sources and further reading
These sources support the workflow described here. They do not promise a specific customer result.
- 01Role-based access control glossary ↗
NIST
Defines access based on organizational roles and the permissions needed to perform defined functions.
- 02Authorization Cheat Sheet ↗
OWASP
Supports least privilege, deny-by-default behavior, permission checks, logging, and authorization tests.
Questions people ask before using it
Should a client ever receive Platform Admin?
No. Platform Admin is global Concept Services administration. Clients should receive an appropriate brand role or project-only grant.
Can one person have different roles across brands?
Yes. Brand roles are scoped per brand, and the same person can also hold direct access to selected projects.
If this problem looks familiar
List the people currently receiving project files by email.
We will map each person to the narrowest Brand Builder access that still lets them do the job.
Review project access