Reporting permissions reference
This page lists the permissions that control access to reporting and analytics features, what each one unlocks, and which role holds it by default.
Permission summary
Section titled “Permission summary”| Permission | Who holds it | What it unlocks |
|---|---|---|
| reports:view | Both Admin variants + Board Member | Admin dashboard (dashboard_get); general reporting read access |
| Report read (report-list access) | Both Admin variants | Reading the report list and viewing saved report results — browsing reports, polling run status, reading row-level results |
| reports:view-board | Board Member / Governance Reader | Board aggregate dashboard (board_dashboard_get) |
| reports:view-finance | Both Admin variants (when granted) | Access to admin finance reports, including Aging receivables; absence denies the finance report |
| reports:view-pii | Admins with the PII grant | Member-identifying rows and drills within an accessible report; absence leaves aggregate buckets |
| reports:run | Both Admin variants | Running pre-built financial reports (reports_run) |
| reports:export | Both Admin variants | Exporting any report (report_runs_export) |
| Member-detail export permission | Both Admin variants (when granted) | Including member names and email addresses in a report export |
What each role can and can’t do
Section titled “What each role can and can’t do”Both Admin variants (Volunteer-Run Nonprofit Admin and Professional Association Staff Admin)
Section titled “Both Admin variants (Volunteer-Run Nonprofit Admin and Professional Association Staff Admin)”Admins hold reports:view, report-list access, reports:run, and reports:export by default. With these, an admin can:
- View the admin dashboard (rate metrics + operational counts)
- List and read saved reports and their results
- Run all pre-built financial reports
- Export rendered reports as CSV when they have at most 1,000 rows; larger report exports are refused
- Drill from dashboard cards into filtered lists
To open the Aging receivables report, an admin needs reports:view-finance; without it, access is denied. Within an accessible report, reports:view-pii controls member-identifying rows and drills. Without that separate PII grant, the admin sees aggregate bucket totals.
Board Member / Governance Reader
Section titled “Board Member / Governance Reader”Board members hold reports:view and reports:view-board. With these, a board member can:
- View the board aggregate dashboard (aggregate metrics and counts, no member names)
- View the board aggregate financial summary
- Receive a separately available aggregate report manually shared by an authorized admin, if it meets the need; the Board portal has no export action or exact-view file, and the Board role lacks
reports:export
Board members do not have an export grant or access to per-member drill-throughs or member names in the Board portal. This is a governance design feature, not a restriction. See How the board view protects member privacy.
Dual-role (Board member who is also an admin)
Section titled “Dual-role (Board member who is also an admin)”A dual-role user can use the admin role and open /admin/dashboard separately to access authorized admin detail. The Board portal always uses the board-role scope and does not provide a working View as admin switch at M1.
If you need a permission you don’t have
Section titled “If you need a permission you don’t have”Contact your organization’s primary admin. They can adjust your role’s permissions in the admin settings.