Enterprise role-based access control for Granola. Use when configuring user roles, setting permissions, or implementing access control policies. Trigger with phrases like "granola roles", "granola permissions", "granola access control", "granola RBAC", "granola admin".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill granola-enterprise-rbacLoading…
Configure role-based access control for Granola with SSO group mapping, per-workspace permissions, sharing policies, and audit logging. Granola's role hierarchy controls who can create, share, and manage meeting notes across the organization.
Organization Owner (1-2 people)
│ Full control: billing, SSO, org settings, all workspaces
│
├── Workspace Admin (per department)
│ Manage workspace: members, integrations, settings
│ All member capabilities
│
├── Team Lead
│ View team analytics, manage folder structure
│ All member capabilities
│
├── Member (default role)
│ Create notes, share internally, use integrations
│
├── Viewer
│ Read-only access to shared notes
│ Cannot create or record meetings
│
└── Guest (external)
Single workspace access, read-only
Time-limited (30-day default expiration)
| Permission | Owner |
|---|
| WS Admin |
|---|
| Lead |
|---|
| Member |
|---|
| Viewer |
|---|
| Guest |
|---|
| Record meetings | Yes | Yes | Yes | Yes | No | No |
| Create notes | Yes | Yes | Yes | Yes | No | No |
| Share internally | Yes | Yes | Yes | Yes | No | No |
| Share externally | Yes | Yes | Policy | Policy | No | No |
| View shared notes | Yes | Yes | Yes | Yes | Yes | Yes |
| Manage integrations | Yes | Yes | No | No | No | No |
| Manage members | Yes | Yes | No | No | No | No |
| View analytics | Yes | Yes | Yes | No | No | No |
| Configure retention | Yes | Yes | No | No | No | No |
| Manage billing | Yes | No | No | No | No | No |
| Configure SSO/SCIM | Yes | No | No | No | No | No |
Configure in Organization Settings > Security > SSO > Group Mapping:
| SSO Group (IdP) | Granola Workspace | Granola Role |
|---|---|---|
engineering-all | Engineering | Member |
engineering-leads | Engineering | Admin |
sales-team | Sales | Member |
sales-managers | Sales | Admin |
product-team | Product | Member |
hr-team | HR | Member |
hr-directors | HR | Admin |
executives | Executive | Admin |
contractors-eng | Engineering | Guest |
Multi-workspace membership: A user can belong to multiple workspaces with different roles:
Set per-workspace sharing rules to control data flow:
Standard workspaces (Engineering, Product, Sales):
Workspace Settings > Sharing:
Internal sharing: Automatic within workspace members
Cross-workspace: Allowed with admin approval
External sharing: Allowed with link expiration (30 days)
Public links: Disabled
Confidential workspaces (HR, Executive):
Workspace Settings > Sharing:
Internal sharing: Manual only (no auto-share)
Cross-workspace: Disabled
External sharing: Disabled
Public links: Disabled
Note visibility: Creator + explicitly added viewers only
Follow the principle of least privilege for role assignments:
## Quarterly Access Review Checklist
- [ ] Pull current user list: Settings > Team
- [ ] Verify each user's role matches current job function
- [ ] Deactivate users who have left the organization
- [ ] Downgrade over-privileged users (Admin → Member where appropriate)
- [ ] Remove expired Guest accounts
- [ ] Verify SSO group mappings match current org chart
- [ ] Review sharing policy compliance per workspace
- [ ] Check audit logs for unusual access patterns
Enterprise audit logging captures:
| Event | What's Logged |
|---|---|
| User login | Who, when, from where (IP) |
| Note created | Creator, meeting, workspace |
| Note shared | Sharer, recipient, method (Slack/Notion/link) |
| Note exported | Who exported, which note |
| Role changed | Admin, user affected, old role → new role |
| Integration connected/disconnected | Who, which integration |
| Workspace settings changed | Admin, what changed |
Access audit logs: Organization Settings > Security > Audit Log
Export audit logs for SIEM integration (Enterprise):
Onboarding:
Role change:
Offboarding:
| Error | Cause | Fix |
|---|---|---|
| User can't access workspace | Wrong SSO group | Verify IdP group membership |
| External sharing blocked unexpectedly | Workspace policy override | Review workspace sharing settings |
| Guest access expired | 30-day time limit | Re-invite the guest or extend expiration |
| SCIM sync delayed | IdP sync interval too long | Trigger manual sync in IdP, or adjust interval |
| Orphaned accounts after termination | SCIM deprovisioning not configured | Enable deprovisioning in SCIM settings |
Proceed to granola-migration-deep-dive for migrating from other meeting note tools.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).