picked.
Log inPost a role
Help center
HelpSecurity and accessRoles and permissions, in full.
Roles and permissions, in full.
The four roles, the granular permissions behind each, and how to keep candidate data on a need-to-know footing.
Last reviewed 12 June 20263 min read

Four roles ship at V1: owner, admin, hiring manager, recruiter. Custom roles are V2.

The permission matrix, in plain terms.

  • Billing and workspace settings. Owners only.
  • Integrations (Slack, calendar, ATS export). Owners and admins.
  • Security policy (SSO, two-factor, session length). Owners and admins.
  • Posting and editing a role. Owners, admins, and hiring managers.
  • Reading the finalist card and overriding a rank. Owners, admins, hiring managers (their own roles), and recruiters (read-only).
  • Pipeline view (volume, drop-off, time-in-stage). Owners, admins, recruiters.
  • Candidate communication. Owners, admins, recruiters.
  • Audit log. Owners and admins.

Need-to-know enforcement.

A hiring manager sees the candidates on their own roles. They do not see candidates on other hiring managers roles, even within the same workspace. A recruiter sees pipeline-level data across roles, but the candidate transcripts open only on the roles where they are explicitly added as a recruiter.

Role transitions are immediate. Downgrading a teammate from admin to recruiter takes effect on their next page load; any open tabs lose the higher-permission surfaces on the next API call. Re-assigning ownership of an in-flight role to a new hiring manager preserves the candidate history and the override log.

Every read of a candidate transcript is logged. Owners and admins can pull the access log per candidate from the audit-log export.

What to do next: review the role of every existing teammate on Settings, Team, and downgrade anyone who does not need owner or admin.

rolespermissionsaccess controlsecurity
Related articles
Getting started
Inviting teammates and setting roles.
Who you invite, what each role can do, and how to keep candidate data on a need-to-know footing.
3 min read
Security and access
SSO, SCIM, SAML, BYOK: what ships when.
Single sign-on availability at V1, the procurement-grade controls that ship with V2, and what you can do today instead.
3 min read
Security and access
Two-factor and session policy.
How to enforce 2FA across the workspace, and how to pick a sensible session length.
3 min read
Still stuck?
One email gets a human reply inside 24 hours.
Email help@picked.aiStatus page
picked.
The AI-native replacement for inbound hiring. For the hiring manager, not HR.
Product
Solutions
Resources
Company
© 2026 Picked · Made in London · Three finalists in forty-eight hours.
Roles and permissions, in full. | Help · Picked.ai