# Roles, actions and additional checks

Use the exact native-table template, shop role, reader grant and review checks rather than relying on a broad route or job title.

Source: https://help.smartfact.ai/manuals/configsheets/roles-and-actions

Review edition: 25 October 2026

Roles: owner, author, reviewer, supervisor, operator, viewer

Use this reference before granting access or transferring a Data task. The table distinguishes ordinary reference tables from the WooCommerce SKU template. It also distinguishes a browser role from a connection's approved source and reader grants. A broad menu or route does not remove the task's more specific authority check.

## Read the permission terms

OR means either listed effective role is sufficient. AND means the same person needs both permissions for the combined task. Another reviewer means a different eligible individual. Current Accounts grants and site assignments can narrow the role a person appears to hold.

Recent verification means an Accounts second-factor check from the last five minutes where stated. Ordinary reads and table edits do not automatically require a new five-minute check. General session verification, current source/version, recovery and connection admission still apply. Connected features may be unavailable at a site even with the named role.

## Match the task to its authority

| Task | Who | Additional conditions | Related guide |
| --- | --- | --- | --- |
| Read Reference tables or Shop connections | Any of the six product roles | Exact real-site permissions for shops and permitted current record scope. Reading is not authority to edit a table or decide an order. | [Viewer](/manuals/configsheets/viewer) |
| Read External sheets, Test a query, Refresh history or Data feeds | Owner OR Operator OR Viewer | Author, Reviewer and Supervisor alone do not inherit these generic reader roles. | [Queries](/manuals/configsheets/queries) |
| Create an ordinary custom/customer-product reference table | Owner | Recent verification. Column schema and identity choices need checking before creation. | [Create a table](/manuals/configsheets/create-table) |
| Edit or save an ordinary reference-table version | Owner OR Operator | Current saved revision, reviewed preview, reason and explicit removal acknowledgement. Author alone cannot edit this ordinary template. | [Edit a table](/manuals/configsheets/edit-table) |
| Create or edit the WooCommerce SKU mapping table | Author | This specific template has Author authority. Its saved version is still not an active shop mapping release. | [Shop mappings](/manuals/configsheets/shop-mappings) |
| Register an external sheet | Owner | Recent verification; one exact spreadsheet/tab pair. Registration does not contact Google or schedule refresh. | [External sheets](/manuals/configsheets/external-sheets) |
| Preview or accept an external snapshot | Owner OR Operator | The accepted snapshot replaces its parameters and all rows together. Failed receive preserves the last good snapshot and failure state. | [External sheets](/manuals/configsheets/external-sheets) |
| Run an ad-hoc query | Owner OR Operator OR Viewer | Current source access and typed exact matches; it creates no reusable rule approval. | [Queries](/manuals/configsheets/queries) |
| Prepare a saved selection through the visible source-selection page | Author AND one of Owner, Operator or Viewer | Author creates the definition, while the page itself requires a generic reader role. Source preparation alone is not publication. | [Saved selections](/manuals/configsheets/saved-selections) |
| Run a released selection in the browser | Owner OR Operator OR Viewer | Exact published unit, approved sources, current source validity and native holds. | [Saved selections](/manuals/configsheets/saved-selections) |
| Run a released selection through a connection | Valid read credential for the source | Its exact key must be an approved reader of the selection AND its source must be approved. The connection sees only that one source, not all selected sources. | [Saved selections](/manuals/configsheets/saved-selections) |
| Create a feed | Owner | Recent verification and supported source-role bindings. Reviewed source-selection policies retain their separate release workflow. | [Feeds](/manuals/configsheets/feeds) |
| Preview a feed or download its retained file/evidence | Owner OR Operator OR Viewer | Correct feed and current preview or retained run. A downloaded file has not been accepted by KitProof merely because it exists. | [Feeds](/manuals/configsheets/feeds) |
| Generate a new feed file | Owner OR Operator | Real site and current reviewed preview. Viewer does not generate new runs. | [Feeds](/manuals/configsheets/feeds) |
| Prepare a supported LabelRules export | Owner OR Operator OR Viewer | Supported customer-product schema, one saved version and verified export settings. No automatic receiving import or printing. | [LabelRules export](/manuals/configsheets/labelrules-export) |
| Save a shop mapping draft | Author | Exact saved SKU version and independently expected examples. Source-version authorship remains part of review independence. | [Shop mappings](/manuals/configsheets/shop-mappings) |
| Preview a shop mapping release | Reviewer | Read all required comparison pages and complete expected outcomes. | [Shop mappings](/manuals/configsheets/shop-mappings) |
| Activate a shop mapping | Reviewer | Recent verification. Reviewer must differ from both mapping author and saved source-version author. Enrolled native publication checks cannot be bypassed. | [Shop mappings](/manuals/configsheets/shop-mappings) |
| Read an order again, resend refused lines or replay retained delivery | Operator | The action must be offered for the current connection/order state. Supervisor alone is not Operator. Retained-event replay preserves original identity and bytes. | [Shop orders](/manuals/configsheets/shop-orders) |
| Decide a binned/deleted order's deduction | Supervisor | Recent verification and reason. Keep or reverse is queued for authoritative reconciliation; a permanently deleted order's recorded decision is final. | [Shop orders](/manuals/configsheets/shop-orders) |
| Configure, check, start or manage the shop connection | Owner | Recent verification, current connected-mode checks and independently activated mapping. This does not give Author or Reviewer authority. | [Application access](/manuals/configsheets/application-access) |
| Create/revoke temporary application credentials | Owner | Recent verification. Credentials remain tied to the issuing Owner's current Accounts session, source and abilities; they are not unattended production credentials. | [Application access](/manuals/configsheets/application-access) |
| Enrol an observation producer or withdraw an observation | Owner | Recent verification, exact source-bound contract and original-request recovery. Revocation and withdrawal have different effects. | [Source observations](/manuals/configsheets/source-observations) |
| Review or activate protected shop retention | Owner | Recent verification for activation and the fixed policy's current protected-work checks. Other roles do not receive the Owner review data. | [History and recovery](/manuals/configsheets/history-export-and-recovery) |
| Download the complete site export | Owner | Real site and recent verification; the private read-only snapshot is not a restoration backup. | [History and recovery](/manuals/configsheets/history-export-and-recovery) |

## Keep role and source grants separate

An Author wanting to create a saved selection from its browser page needs Author AND a generic reader role. SKU-table authoring requires Author. It grants no permission to edit ordinary reference tables. Someone responsible for both order read/replay and deduction decisions needs Operator AND Supervisor.

A connection's read ability is not a grant to every source or selection. Current issuing-session authority, source binding, approved reader identity, revocation and recovery generation are checked separately. Reviewed rule publication does not widen that credential. For Automation-managed changes, arrange the appropriate Author and independent Reviewer in Automation and the native product as well.