Permission Levels and Access Control

Understand the basics of setting up users, teams, and permissions on SpotDraft

Members

A member is anyone who can log in to SpotDraft. You can add members via the instructions found in "Inviting a new team member". Members can utilize SpotDraft according to the permissions assigned to them directly or through their team(s). They may belong to more than one team.

Teams

A team consists of a group of members. Teams simplify granting the same set of permissions to multiple members.

For example, if 10 people are allowed to manage your contract type, workflows, and key pointers, it is simpler to add them to a team and assign the permissions to the team. Similarly, if they are allowed to create an Order Form contract, it is simpler to add the team as the creator of the Order Form contract type instead of adding all 10 of them as creators separately.

Team point of contact (POC)

Each team has a designated Point of Contact (POC), responsible for managing their specific team. Only the POC and admins have the authority to add or remove members from the team. The 'Manage Team' and 'Manage Members' permissions grant the POC the ability to oversee the members within their team. POCs do not have access to manage members of other teams.

Another aspect of the POC is that a task, like a review assigned to a team, is directed to this member, who receives the necessary notifications. They can then handle or assign the task to another team member.

Team permissions

Each team can have a specific set of permissions enabled. Except for the default Admin team, permissions for each team are configurable. It's important to note that the Admin team has comprehensive platform access. Ideally, only select individuals should belong to this team.

For example, you can create a team called IT Admins and enable permissions such as Manage Integrations, Developer Settings, Manage Security and Identity. Any member added to this team will gain access to perform the respective operations.

Exception: Members of the default Admin team have the unique ability to manage all other teams, regardless of whether they are members of those teams. However, aside from this exception, a member’s permissions are determined solely by the permission toggles configured for the team(s) they belong to. Remember that a user's permission is a union of all the permissions that are inherited from all the teams that they belong to.

The user will be allowed to create and make changes to workflows using the Workflow Manager, including setting up Express Contract templates

Contract, Workflows, and Intake permissions

Workspace permissions

Note: Users with Creator access to a contract type can initiate and submit Express Contracts (via + New > Express contract) and share Express Contract links with counterparties without needing “Manage Contract Types and Workflows” permission. The Workflow Manager permission is only required for setting up and configuring Express Contract templates.

Practical Scenarios for Manage Counterparties Permission

Contract Creation/Upload Workflow Requirement: When team members are uploading contracts or creating new contracts and need to add a counterparty that doesn't already exist in the system, they must have the ‘Manage Counterparties’ permission enabled. Without this permission, users will be unable to add new counterparties during these workflows, even if they have other necessary permissions like ‘Upload Contracts’ or contract type creator roles.

Permission Restrictions: Users without the ‘Manage Counterparties’ permission are restricted to selecting only from pre‑existing counterparties in dropdown lists. They cannot add new counterparty names or use AI suggestions to populate counterparty fields.

Troubleshooting Tip: If users report being unable to add counterparties during contract creation or upload, or if they cannot see AI suggestions for counterparty names, check that their team has the ‘Manage Counterparties’ permission enabled in addition to their other contract‑related permissions.

Roles

Contract type roles

You can assign a member or team to any of the following pre-defined roles, each with corresponding permissions.

Creators: Allowed to create contracts of the selected type and act as the business user.

Viewers: Allowed to view all contracts of the selected type.

Suggesters: Allowed to make edits to contracts of this type, with changes tracked, provided they are also added as viewers. Their edits require approval from an editor before they reflect on the document.

Editors: Allowed to make edits to contracts of this type, as long as they are either added as viewers of the contract type or requested to review a contract of this type. If their review is requested, they also become the legal user of the contract.

Signatories: Allowed to act as signatories for contracts of this type. The business user will select the required signatory from the list.

Controlling Contract Visibility by Team

When a contract type is used by multiple teams, you can ensure that contracts created by one team are visible only to that team.

If a contract type is shared across multiple teams (for example, Sales US, Sales EMEA, and Sales EU), you can enable the option “Automatically grant viewer access to creator’s team members.”

When this option is enabled:

• All members of the team(s) that the contract creator belongs to automatically get viewer access to the contract.

• Other creator teams will not be able to view the contract unless they also belong to the creator’s team.

For example, if a Sales US user creates a Master Service Agreement (MSA), all members of Sales US will be able to view the contract, but Sales EMEA and Sales EU will not.

If certain users or teams should have access to all contracts created using this contract type, add them to the Viewers list.

In the example above, the Legal team is added as a viewer. This means the Legal team will have view access to all MSAs, regardless of which Sales team created them.

Note: If a user belongs to multiple teams, all members of those teams will receive access when that user creates a contract. For example, if a user is part of Sales EMEA and Sales EU, members of both teams will be able to view the contract they create, along with any teams added as Viewers.

Contract roles

Business user: The creator of a contract is automatically the business user, and they receive all notifications related to the contract and have permission to perform basic operations like requesting reviews and sending the contract out for collecting signatures. It is possible to reassign the business user, and the list of business users that gets populated in the selection dropdown is from the list of creators added at the contract type level.

Legal user: Business users can request reviews from a predefined set of legal users (Editors) when legal input is required. The selected reviewer becomes the legal user of the contract. It is also possible to assign a legal user without requesting a review by going to the party information card on the contract summary page.

Approver: When approval is triggered for a contract based on pre-defined conditions on the workflow or when an ad-hoc approval is requested, the member whose approval is requested gains access to this contract.

Signatory: The signatory designated to sign a contract gets access to this contract.

Follower: A Follower is any user who is actively tracking a contract's progress. Unlike other roles, "Follower" is a role focused entirely on visibility and organization.

• How it's assigned: You are added as a follower automatically when you are @mentioned, assigned a task, or are the designated Business/Legal user. You can also manually follow a contract.

• No Added Permissions: Being a follower does NOT grant any additional access, viewing rights, or editing privileges. You must already have permission to view a contract to see it in your "Following" list.

• Purpose: This role ensures the contract is surfaced in your personalized Home page and the "Following" view in the Repository, making it easy to track without being the contract "owner."

Permission matrix

Restrict editing of the template questionnaire for a contract

In this section, you will learn how to add restrictions on who can edit the template questionnaire of a template contract.

📖  Navigating to access control settings for a contract type

1. Select Access Control from the Settings section in the left navigation.

2. Select Contract Types from the top header

📖  Setting up restrictions to edit the template questionnaire

1. Find the required Contract Type and click on the edit button

2. Select Advanced Settings and change the setting from Allowed to Blocked

📖  Adding a list of exempted users

1. If you wish to allow certain teams to perform this restricted action, select them from the dropdown.

2. Save your changes

💡Example of a use-case: The sales team will create the contracts, answer the questionnaire, and send it to the counterparty. If the counterparty wishes to change certain terms of the contract, only the legal team can access the questionnaire to edit the answers to the questions.

Inviting users

In certain situations, you might require input on a contract from individuals who aren't predefined within your contract settings. In these cases, you can use the Invite Team feature. This feature allows you to grant specific permissions (such as viewer, suggester, or editor) to these individuals based on your permissions. For example, if Jane has suggester privileges for a contract type, she can invite others as suggesters or viewers, but not as editors.

This feature also enables you to invite people who aren't already part of your SpotDraft workspace. This is particularly useful when you need input from external legal counsel on specific contracts. When such individuals are invited, they're added to the list of members. However, until they're assigned to a team or role, they won't have access to anything except the contract they're invited to review.

Note:

1. This is not intended to invite a counterparty into the contract. If you need the counterparty to collaborate on a contract, send it to them for review.

2. For added security, it's possible to whitelist a specific set of domains from which users can be invited.

3. The permission that a user will have on a contract will be the union of the permissions they gained from the contract type and the individual contract. For instance, if Jane is added as an editor to the MSA contract type, but not as a viewer, she will not be able to view any MSAs. But if she’s invited as a viewer to an MSA, then she will be able to view it and edit it.

Permission matrix

FAQ

1. I've added John as an editor for my NDA contract type. Why can't he access or view any of the NDAs created by my business team?
   
   Adding John as an editor doesn't automatically grant him permission to view or access contracts. It simply allows him to edit them once he gains viewing access. He can gain access in three ways:

   1. The business user can use the Request Review option on the contract and select John as the reviewer. This grants him access to that specific contract.

   2. The business user can use the Invite Team option on the contract and select John as a viewer. This grants him access to that specific contract.

   3. John can be added as a viewer to the NDA contract type. This grants him access to all the NDAs created.

2. Can an admin access all the contracts?
   
   By default, admins cannot access any contracts. However, they possess the ability to make any change to the workspace. This means they can add themselves as a contract-type viewer, editor, etc., and gain access.