"Everyone can do everything" is a security incident waiting to happen

When a signing workspace is small, it is tempting to give everyone full access and move on. It works right up until it doesn't: a junior hire can void a live envelope, a contractor can read every executed agreement in the company, or a departing employee still has the keys to send documents under your brand. Access control is not bureaucracy — it is the boring discipline that keeps a sensitive, years-long asset in the hands of the people who should hold it.

This is a practical tour of roles and permissions in a shared e-signature workspace: what each role is for, why least privilege is the right default, and how the read-only auditor role and per-folder visibility let you give people exactly the access they need and nothing more.

Roles: matching access to the job

The core idea is that what someone can do should follow what their job requires. A useful set of roles for a signing workspace:

  • Owner / admin. Manages the workspace itself — billing, team membership, branding, and policy. This is the most powerful role, so it should be the rarest. Two admins is usually plenty; ten is a liability.
  • Member / sender. The working majority. They create envelopes, send documents, use templates, and track their own signature requests. They can act, but they don't reconfigure the workspace.
  • Auditor (read-only). Can see records but cannot change anything — covered in its own section below, because it is the role most teams overlook and most need.

The reason roles beat ad-hoc permissions is that a role is a policy: when someone's job changes, you change their role, and their access follows automatically. You are never trying to remember which of forty individual toggles a person should have.

Least privilege by default

The governing principle is least privilege: a new user starts with the minimum, and access is granted explicitly when a real need appears. This is the opposite of the common pattern — handing everyone broad access and clawing it back only after something goes wrong.

Least privilege costs a little friction up front and saves you from the expensive failure modes: the contractor who could read deals they were never part of, the account that kept admin rights long after the project ended. Pair it with prompt removal when someone leaves, and the size of your exposure shrinks to the people who actually need it today. Every action those people take is still recorded in the security audit log — sign-ins, role changes, API key lifecycle — so "who could do this" is backed by "who actually did."

The read-only auditor role

The role most teams don't think to create is the one a dispute or a compliance review needs most: a person who can see everything relevant and change nothing.

An auditor — internal compliance, outside counsel, a client's reviewer — needs to inspect the envelope register, confirm who signed and when, and pull the audit certificate and evidence bundle for a given agreement. What they must not be able to do is send, void, or alter anything. A read-only auditor role gives them exactly that: full visibility for review, zero ability to act. It means you can satisfy a regulated-industry review or hand a reviewer access to the CSV export of the envelope register without ever risking that they change a live document. Granting "read everything" should never require granting "do anything."

Per-folder visibility: scoping who sees which documents

Roles control what kind of action someone can take; per-folder visibility controls which documents they can take it on. The two work together.

Organize templates and envelopes into folders, then scope visibility per folder so that, say, HR's offer letters aren't visible to the sales team and a sensitive legal matter is confined to the people working it. This is the practical mechanism behind "sales sees their deals; legal sees all" — instead of one flat pile every member can browse, access maps to the structure of the work. It is especially valuable as a workspace grows past the point where everyone reasonably needs to see everything.

Putting it together

  1. Assign roles by job, not by seniority or convenience. Keep admins few.
  2. Default to least privilege; grant more only on a real need, and remove access promptly when someone leaves.
  3. Create a read-only auditor role for reviewers and compliance, so visibility never implies the power to change anything.
  4. Use folders and per-folder visibility to confine each document to the people who should see it.
  5. Lean on the audit log so the access policy is backed by a record of who actually did what.

The takeaway

Access control in a signing workspace comes down to a simple sentence: the right people can act, and everyone else can only see what they should. Assign roles by job and keep admins rare, default to least privilege, give reviewers a read-only auditor role so they can inspect everything and change nothing, and use per-folder visibility to scope documents to the teams that own them. Done once, it runs quietly in the background and keeps a sensitive, long-lived asset out of the wrong hands. Set up your team's roles and folders.

This article is general guidance, not legal or compliance advice.