Skip to main content

​
Overview

Forest enables admins to create and manage custom roles with granular permission controls. The roles system allows organizations to define what actions users can perform within the platform. Only users with Admin permission level can create and manage roles. Roles are configured in the Roles tab within project settings, where permissions apply to all users assigned to that role.

​
Permission levels

Forest defines five user permission levels with increasing administrative capabilities: *Based on collection and action permissions configured for the role

​
Roles

Roles are configured in Project Settings → Roles. Each role defines granular permissions for collections and actions.

​
Collection permissions

Control what users can do with data in each collection:

​
Action permissions

Control user ability to trigger and approve actions:

​
Approval workflows

When “Require Approval” is enabled for an action:
  1. User triggers the action
  2. Action enters pending state in the approval queue
  3. Users with “Approve” permission review the request
  4. Action executes once approved (or is cancelled if rejected)
Approval lifecycle: a triggered action becomes Pending, then either Approved (and Executed) or Cancelled This workflow ensures sensitive operations (like refunds, data exports, or account deletions) go through proper review before execution. Learn more about action approval workflows →

​
Copy permissions across environments

Role permissions are configured per environment. To replicate a permission setup from one environment to another (for example, from staging to production), use Actions → Copy roles permissions across environments in Project Settings → Roles. Requirements:
  • You need the Admin permission level
  • Your project needs at least two remote environments, production included. Development environments aren’t eligible, and the Actions button doesn’t appear until you have two
  • Both environments must have the same schema, otherwise Forest rejects the copy with an error
If the schemas differ, for example between a legacy agent’s environment and a new one’s during a migration, move the permissions through a file instead.
The copy overrides all permissions of the destination environment, for all roles.
  1. Select the environment to copy from
  2. Select the environment to copy to
  3. Click Copy
The copy runs in the background and can take a few minutes. When it’s done, you get an email. Refresh your browser to see the updated permissions.

​
Conditional permissions

Restrict permissions based on data conditions using filters. For example, operators might trigger refunds under $1,000 without approval, while higher amounts require authorization. Conditional permissions allow you to:
  • Set data-based filters on any permission
  • Create dynamic permission rules based on field values
  • Combine multiple conditions with AND/OR logic
  • Apply different permission levels based on record data
Example: Allow the “Support” role to trigger refunds only when amount < 1000, otherwise require approval.

​
Default permissions

Configure default permissions that are automatically applied when new collections or actions are created. This ensures consistent permission settings across your project without having to manually configure each new collection or action. Default permissions are configured in Project Settings → Roles and apply to:
  • New collections added to your datasources
  • New actions created in the back-end
  • New fields added to existing collections
This saves time and ensures security by establishing baseline permissions that new elements inherit automatically.