granola-enterprise-rbac

# Granola Enterprise RBAC ## Overview Configure role-based access control for Granola with SSO group mapping, per-workspace permissions, sharing policies, and audit logging. Granola's role hierarchy controls who can create, share, and manage meeting notes across the organization. ## Prerequisites - Granola Enterprise plan ($35+/user/month) - Organization admin access - SSO configured (Okta, Azure AD, or Google Workspace) - SCIM provisioning enabled (recommended for automated role assignment) ## Instructions ### Step 1 — Understand the Role Hierarchy ``` Organization Owner (1-2 people) │ Full control: billing, SSO, org settings, all workspaces │ ├── Workspace Admin (per department) │ Manage workspace: members, integrations, settings │ All member capabilities │ ├── Team Lead │ View team analytics, manage folder structure │ All member capabilities │ ├── Member (default role) │ Create notes, share internally, use integrations │ ├── Viewer │ Read-only access to shared notes │ Cannot create or record meetings │ └── Guest (external) Single workspace access, read-only Time-limited (30-day default expiration) ``` ### Step 2 — Permission Matrix | Permission | Owner | WS Admin | Lead | Member | Viewer | Guest | |-----------|-------|----------|------|--------|--------|-------| | Record meetings | Yes | Yes | Yes | Yes | No | No | | Create notes | Yes | Yes | Yes | Yes | No | No | | Share internally | Yes...