Krög X · Roles & permissions
Roles, not shared passwords.
Four roles, set per client. Each person gets the access their job needs on each client and nothing else. Nobody signs in as somebody else, and every action carries a name.
01The four roles
Pick a role, see what it can do.
Admin, Media buyer, Finance and Viewer cover how ad teams split the work. Choose one to light up its permissions.
What a Media buyer can do:
Workspaces
- AllowedSee the client workspaces they are added to
- Not allowedCreate, rename and archive workspaces
Profiles
- AllowedOpen the profiles assigned to them
- Not allowedCreate profiles and assign people
- AllowedWrite notes and checklists
- AllowedHand off work to a teammate
Vault
- AllowedSign in with a shared login (autofill)Only where the entry's rule allows it
- Not allowedReveal a shared password
- Not allowedAdd entries and set their rules
Team
- Not allowedInvite and remove teammates
- Not allowedChange someone's role
Billing & log
- Not allowedSee Krög X invoices and seats
- Not allowedRead the audit log for their workspaces
- Not allowedExport the audit log
| Permission | ||||
|---|---|---|---|---|
| Workspaces | ||||
| See the client workspaces they are added to | Allowed | Allowed | Allowed | Allowed |
| Create, rename and archive workspaces | Allowed | Not allowed | Not allowed | Not allowed |
| Profiles | ||||
| Open the profiles assigned to them | Allowed | Allowed | Not allowed | Not allowed |
| Create profiles and assign people | Allowed | Not allowed | Not allowed | Not allowed |
| Write notes and checklists | Allowed | Allowed | Not allowed | Not allowed |
| Hand off work to a teammate | Allowed | Allowed | Not allowed | Not allowed |
| Vault | ||||
| Sign in with a shared login (autofill)Only where the entry's rule allows it | Allowed | Allowed | Not allowed | Not allowed |
| Reveal a shared passwordLogged, with a reason | Allowed | Not allowed | Not allowed | Not allowed |
| Add entries and set their rules | Allowed | Not allowed | Not allowed | Not allowed |
| Team | ||||
| Invite and remove teammates | Allowed | Not allowed | Not allowed | Not allowed |
| Change someone's role | Allowed | Not allowed | Not allowed | Not allowed |
| Billing & log | ||||
| See Krög X invoices and seats | Allowed | Not allowed | Allowed | Not allowed |
| Read the audit log for their workspaces | Allowed | Not allowed | Allowed | Allowed |
| Export the audit log | Allowed | Not allowed | Allowed | Not allowed |
02Per client
Roles are set per client.
The same person can be an Admin on one client, a Media buyer on another and have no access to a third.
- AA
Agency admin
- Outdoor retail
- Admin
- Dental group
- Admin
- B2B software
- Admin
- BA
Buyer A
- Outdoor retail
- Media buyer
- Dental group
- No access
- B2B software
- No access
- BB
Buyer B
- Outdoor retail
- No access
- Dental group
- Media buyer
- B2B software
- Media buyer
- FL
Finance lead
- Outdoor retail
- Finance
- Dental group
- Finance
- B2B software
- Finance
- CV
Client viewer
- Outdoor retail
- No access
- Dental group
- Viewer
- B2B software
- No access
| Person | Outdoor retail | Dental group | B2B software |
|---|---|---|---|
| AAAgency admin | Admin | Admin | Admin |
| BABuyer A | Media buyer | No access | No access |
| BBBuyer B | No access | Media buyer | Media buyer |
| FLFinance lead | Finance | Finance | Finance |
| CVClient viewer | No access | Viewer | No access |
The admin runs the agency.
Admin on every client: invites people, sets vault rules, removes seats.
Buyers A and B buy media.
Each opens only the clients they buy for. Buyer B never sees the outdoor retail workspace.
The finance lead closes the month.
Finance on every client: invoices and the log, without opening a single profile.
The client reads along.
The dental group's marketing lead, as a Viewer: reads notes and the log for that workspace only.
03Lifecycle
Joining, changing roles, leaving.
The moments where shared passwords usually go wrong, each one a single step.
- 01
Invite
An Admin invites a teammate by email and picks a role on each client. New seats start with no client at all.
- 02
Set up two-factor
Required before the first profile opens. The invite expires after seven days if it is not accepted.
- 03
Change a role
Promote, demote or move someone between clients. It applies on their next action and goes into the log.
- 04
Remove the seat
Open sessions end, vault access is revoked from every entry, and their history stays in the log.
04Defaults
Safe by default.
The rules that apply before anyone changes a setting.
Least access first
A new seat sees nothing until an Admin adds it to a client, with a role.
Personal logins stay personal
Each person's own platform logins are theirs alone. Admins can remove a seat, not read its logins.
Never without an Admin
The last Admin on a workspace can't be removed or demoted, so no client is ever orphaned.
Admins are logged too
Role changes, rule edits and password reveals carry the Admin's name like every other action.
- Planned
Access requests
A teammate asks for a client; an Admin approves or declines, and the decision is logged.
- Planned
Single sign-on
Seats managed from your company's identity provider.
Krög X is in development. This page describes what we are building; details can change before early access.
— Early access
Bring your team to Krög X first.
Krög X opens to a small group of teams before the public launch. Tell us how your team works and we'll reach out when a seat is ready.
- Krög clients are invited first
- No launch date until it is ready
- Pricing in writing before anything is billed
- Your feedback sets the order of the roadmap