Test roles and permissions with one test account per role

Testing roles and permissions

Permission bugs are the ones that leak data. Finding them means signing in as every role, including the ones you hope can't do much, and as a user from a different customer.

Updated October 13, 2026

The accounts you need

Account	Role	What it checks
Owner	Created the workspace	Billing, deleting the workspace and handing over ownership
Admin	Invited as an admin	Managing people and settings, but not ownership
Editor	Invited as an editor	Creating and changing content, nothing about people or billing
Viewer	Invited as read-only	Can look but not change anything, including through direct links
Removed	A member who was then removed	Loses access at once, including in browsers already signed in
Pending	Invited, never accepted	Can’t get in until accepting, and the invite expires when it should
Other customer	An admin in a second workspace	Can’t see or reach the first workspace’s data at all

Set them up

Create one address per role: choose Add account, set How many, label the batch “Roles” and tick Generate persona.
Sign up as the owner and invite the others by email from your app, each with its role.
Accept each invite from its row: the invite email shows an Accept invite button. Set a password and save it on the address.
Tag each address with its role and note anything unusual, such as “Editor in workspace A only”.

What to check

What each role sees: only the menus, pages and buttons it should.
Hidden isn’t blocked: signed in as the viewer, open an editor’s page directly by its link and try to save a change. Your app should refuse it, not just hide the button.
Role changes take effect straight away, with an email if your app sends one.
Removed users and expired invites can’t get back in, even with an old link.
Other customers: the second workspace’s admin can’t reach the first one’s data by changing an id in a link.

The emails to check

Invites, invite reminders, “your role changed”, “you were removed” and ownership transfer. Invite links usually work once: Proxy Mail QA never opens links itself, so the link still works when you click it.

Built your app with Base44? Its guide covers roles in Base44 apps. Use these accounts only on apps you build or are allowed to test, in development, staging or QA.

Try it on your next sign-up test

Free plan, no credit card. Create an address and watch the code or link arrive.

Create a free accountOpen the app

Questions

How do I give test accounts a role in my app?

Invite them from your app the way an admin would, using Proxy Mail QA addresses. Each invite arrives on its row with an Accept invite button. If your app has no invites, sign up with each address and set the role in your admin.

How do I remember which account has which role?

Tag each address with its role and save its password on the address. The Accounts page filters by tag, so the viewer account is two clicks away.

Should I test across customers too?

Yes, if your app has customers, teams or workspaces. Set up two, each with its own users, and check that nobody in one can see or change anything in the other.