Set Up Label Permissions Using Account Roles (Legacy Governance Model)

Account roles let you control who can create, manage, and edit global labels and label groups, and who can edit labels that other users shared. This article applies to accounts that use the legacy governance model with account roles. If your account uses Teams, see Set Up Label Permissions Using Team Roles. To check which model your account uses, see User Roles and Permissions.

You set who can see a private or shared label on the label itself. For that, see Set Up Labels.

Before you begin: To change account roles, you must be an Account Admin or have a role with Manage Roles & Permissions selected.

Default label permissions

All users can:

• Create, apply, and remove their own private labels.

• See global labels across the account.

• Share their private labels with specific users. The label is then no longer private and is accessible only by the users they choose.

Users with the Account Admin account role (see Account Roles) can also:

• Edit shared labels and label groups of other users.

• Edit global labels and label groups.

• Edit all automated labeling rules.

Label permissions in account roles

An account role has a Labels section with these permissions. All of them are turned on by default for Account Admins.

Change the label permissions of an account role

1. Navigate to Settings > Roles & permissions > Account roles.

2. Click the account role you want to change, or create a new one.
   The account role panel opens.

3. Find the Labels section.

4. Select or clear the label permission checkboxes as needed.

5. Click Save.

6. Assign the role to the users who need it:

   1. Navigate to Settings > Users.

   2. Click the user.

   3. In Account role, select the role.

The new permissions take effect when you assign the role to the user.

Related topics

• Set Up Labels

• Account Roles

• How to Integrate Advanced Permissions with Rule-Based Labeling

• Organize Users into User Groups