Roles and Permissions in Warp

How to customize roles and permissions in Warp

Warp gives you fine-grained control over what each admin can see and do — down to the product area and action level. This guide covers how to set up roles, assign the right permissions, and keep your admin access organized as your team grows.

What's changing and what's not

If you're an existing Warp admin - Nothing has changed for you. Your current permissions remain exactly as they are, regardless of your role.

If you're setting up new admins going forward - New admins will be assigned access based on the default role selected at invite. Default roles follow a least-privilege model — they include only what that function needs and nothing else. Any additional access has to be explicitly granted. For example, the HR Manager role does not include payroll access by default. If an admin needs payroll access, you'll need to add it manually via a custom role.

Where to manage admin access

Go to Settings > Admins.

You'll see four tabs:

Don't see this page? You need Authorized Users: Read access to view the Admins area at all. To invite admins, change roles, or edit permissions, you need Authorized Users: Write or Manage. If you need your own permissions updated, reach out to your company's Owner or main admin — Warp Support can't grant or change permissions without owner approval.

Key concepts

Admins

Admins are users who can log into your company's Warp admin workspace. Each admin has a name, email, role, and status — either Active or Suspended.

Suspending an admin disables their access but keeps them in the list (useful if someone is on leave or you need a paper trail). Removing an admin fully revokes their access.

Owner

Every Warp company has one Owner. The Owner has protected access — they can't be suspended or removed from the Admins page. The Owner, or any admin with Authorized Users: Manage, is responsible for approving role and permission changes across the team.

Roles

A role is a saved set of permissions. When you assign a role to an admin, they immediately get the access that role defines — nothing more, nothing less.

Each role has:

• Name — shown in tables and dropdowns

• Description — optional, shown when selecting a role

• Color — used for role tags in the sidebar

• Permissions — what the role can actually do

One role can be assigned to as many admins as you need — you build it once and apply it to everyone with that function. If you update a role, the change takes effect immediately for every admin using it. Warp shows you exactly who'll be affected before you confirm.

Permission levels

Each permission area — like Payroll, Benefits, or Workers — can be set to one of four access levels:

Not every permission supports all four levels. For example, Worker Dependents and Dependent PII (personally identifiable information — sensitive data like SSNs, dates of birth, and home addresses) only go up to Write.

Default roles

Warp comes with nine pre-built roles covering the most common use cases. You can assign these as-is or use them as a starting point for something more tailored.

If a default role doesn't exist in your company yet, Warp creates it automatically when you select it from the dropdown.

Custom roles

Use a custom role when none of the defaults are quite right. Common examples:

• A payroll-only role for someone who runs payroll but shouldn't touch HR data

• A read-only finance role for someone who needs to see payroll output but not edit anything

• A limited HR role for an HRBP who manages one team but shouldn't see company-wide personally identifiable information

• An IT role scoped to device management with no access to compensation or benefits

To create a custom role:

1. Go to Settings > Admins > Roles

2. Click Create new role

3. Enter a name, optional description, and color

4. Set permissions in the Access section (use Capabilities to get started faster — see below)

5. Click Create role

You can also create a new role on the fly while inviting an admin or updating an existing admin's role.

To edit an existing role:

1. Go to Settings > Admins > Roles

2. Open the actions menu next to the role

3. Click Edit role

4. Update the name, description, or permissions

5. Review which admins will be affected — Warp surfaces this before you confirm

6. Confirm the change

The Admin role cannot be edited — it represents full, unrestricted access to your Warp account.

Capabilities

When building a custom role, Capabilities are a faster way to get started. Instead of setting every permission manually, you pick a Capability and it fills in the full set of permissions that function typically needs.

You can still tweak individual permissions after applying a Capability — they're a starting point, not a lock-in.

If you remove a Capability, it removes the permissions it added — unless another applied Capability also needs them.

Common role combinations

Not sure what permissions someone actually needs? Here are the most common setups:

Someone who runs US payroll end-to-end Use the Full Payroll Manager default, or apply Run US Payrolls and add:

• US Compensation: Read (to see pay rates)

• Tax Compliance: Read (to catch filing issues)

• Worker Banking: Write (to update direct deposit if needed)

Someone who handles onboarding and offboarding Apply Hire People. If they also manage time off policies or assign pay schedules, add:

• Time Off: Manage

• Pay Schedules: Manage

A benefits admin who also manages dependents Apply Administer Benefits — this already includes Worker Dependents: Read and Dependent PII: Read. If they need to update dependent SSNs or DOBs, bump Dependent PII to Write.

An IT admin scoped to provisioning only Apply Provision IT Access. Leave Employee & Contractor Profiles at Read and skip everything else.

A finance reviewer who should see — but not touch — payroll Skip Capabilities and set manually:

• US Payrolls: Read

• Global Payrolls: Read

• General Ledger: Read

• US Compensation: Read

• Worker Banking: Read

Inviting admins

1. Go to Settings > Admins

2. Enter the person's first name, last name, and email

3. Select a role — or create a new one right from the dropdown

4. Click Invite

Invites expire after 7 days. You can resend or revoke them from Settings > Admins > Pending Invitations.

Managing existing admins

In Settings > Admins, each row shows the admin's name, email, role, and current status.

Changing a role mid-workflow? Permission changes take effect immediately — they don't wait for an active payroll run or pending approval to finish. Make sure any in-flight work is handed off or completed before changing or removing access.

You cannot update, suspend, or remove the Owner from this table.

Requiring MFA

Go to Settings > Admins > Security and enable Require MFA.

Once enabled, all company admins must use multi-factor authentication to log in. We recommend turning this on for any company with more than one admin, especially if anyone has access to payroll, PII, or billing.

Permission reference

Use this section when building a custom role and you need to know exactly what a permission covers at each level.

Workers

Payroll

Offers

Expenses

Company

Time Off

Shifts

Finance

Benefits

Compliance

IT

Learning

Settings

Developer

Best practices

Start narrow, expand as needed. It's easier to add permissions later than to explain why someone had access they shouldn't have. Default to Read where you're unsure, and only escalate to Write or Manage when the role clearly requires it.

Be intentional with high-risk permissions. Worker sensitive data (PII), Worker Banking, US/Global Payrolls: Manage, Billing, Developer, and Authorized Users: Manage all carry real risk if they end up with the wrong person. Review these carefully before assigning.

Use Suspend instead of Remove when in doubt. Suspending keeps the admin in your list with their role intact, making it easy to restore access if needed. Removing is permanent.

Audit roles when your team changes. When someone changes roles internally, leaves the company, or moves to a different function, update or remove their admin access the same day. Stale access is one of the most common issues we see.

Name custom roles clearly. "Payroll - Read Only" is more useful in a dropdown than "Finance Custom 2." The description field helps too — it shows up when someone is selecting a role during an invite.

Frequently asked questions