Permission sets and roles
Last updated 10 October 2026.
Docable’s access comes from its own permission sets plus a licence check, on top of your Salesforce object, field, record and File access. Any number of people can hold each set. Some sets say what a person may do; others, the access sets, open the screens and records a role needs and carry no capability of their own.
Roles
Give each person one role in Docable Setup › People and access. Each role is a Salesforce permission set group that bundles the sets below, so it also shows in Salesforce Setup. No role both writes and approves templates.
| Role (permission set group) | What it holds |
|---|---|
| Docable Admin | Docable Manage Installation, Docable Diagnose and Docable Lifecycle Reviewer. Sets Docable up; doesn’t write, approve or make documents |
| Template Author | Docable Configure, Docable Definition Author, Docable Proof Author, Docable Use AI and Docable Analyse Files, plus Docable AI Authoring Storage when the AI extension is installed |
| Approver | Docable Activate Template, Docable Lifecycle Reviewer and Docable Approve Snippet |
| Document User | Docable Generate and Docable Runtime Generator Storage |
Extra access
Kept out of the roles on purpose and given on People and access only to the people who need it.
| Extra access | For |
|---|---|
| Docable Brand Manager | Making and changing Brand Kits. An admin can give it to anyone, themselves included |
| Docable Approve Brand | Approving Brand Kit versions |
| Docable Generate in System Mode | Requesting system mode on a template that allows it |
| Docable Schedule Manager | Activating schedules on the Schedules tab. A schedule runs as the person who activated it |
| Docable Execute Providers and Docable Manage Providers | Running and registering value providers |
| Docable Portal Requester | Experience Cloud members and site guests |
Removing a role also removes the extension set it added. A template author without Brand Manager starts a template with an approved kit or None for now.
Capability sets
| Permission set | What it allows | What it does not allow |
|---|---|---|
| Docable Configure | Discover permitted fields, create and edit your own and shared templates, read Brand Kits and use approved ones, validate, and view drafts you can access | Access to business records you are denied, or approval |
| Docable Activate Template | Explicit human approval of the exact current template version, and making it active | Authoring, automatic approval or elevated data access |
| Docable Approve Brand | Explicit human approval of the exact current Brand Kit version | Template activation or data access |
| Docable Approve Snippet | Publishing the current draft of a snippet as its next approved version for every author | Changing any template |
| Docable Manage Brand Kits | Creating, changing, approving, retiring and deleting Brand Kits and their document number series. Part of Docable Brand Manager | Authoring templates or approving templates |
| Docable Generate | Running permitted active templates against records you can see, and getting the output Files | Authoring, approval or elevated data or File access |
| Docable Generate in System Mode | Letting a generation request ask for system mode on a template that allows it | Authoring, approval or any other data access |
| Docable Portal Requester | For Experience Cloud members and site guests: the request and download calls, and sending the request event | Record, template or File access. The work runs as the designated generation user |
| Docable Use AI | AI tasks, which also need Docable Configure and a Salesforce AI entitlement | File analysis |
| Docable Analyse Files | File analysis | File access, automatic selection or an AI entitlement |
| Docable Manage Providers | Registering data providers | Running them, or calling an arbitrary Flow, class, credential or endpoint |
| Docable Execute Providers | Running a separately declared approved provider | Calling an arbitrary Flow, class, credential or endpoint |
| Docable Diagnose | Allowlisted diagnostics and a sanitised support export | Raw customer, provider or model payloads |
| Docable Manage Installation | Package and licence setup | Silently assigning powerful permissions, or configuration and generation access |
Access sets
| Permission set | What it opens |
|---|---|
| Docable Definition Author | The authoring screens and records: Docable Studio, templates, Brand Kits, snippets and number series |
| Docable Proof Author | Making proofs and comparing versions |
| Docable Lifecycle Reviewer | The review screens: proofs, approvals, the audit trail and the Docable Setup tab. It reads every Brand Kit |
| Docable Runtime Generator Storage | The Generate screens and the generation runs, items and outputs |
| Docable AI Authoring Storage | The AI Studio tab and the records of AI tasks |
| Docable Brand Manager | The Brand Kit screens, with managing and approving Brand Kits. Brand managers see every kit |
An access set alone gives no capability: someone with Docable Runtime Generator Storage but not Docable Generate gets Docable’s CapabilityUnavailable answer.
What someone without a set sees
Someone without any Docable set gets Salesforce’s own access error. Someone without a Docable licence is refused with ACCESS_LICENCE_REQUIRED. See Error and reason codes.
Next
Something unclear or wrong? Tell support.