---
title: "Test roles and permissions with one test account per role · Proxy Mail QA"
description: "Check what owners, admins, editors and viewers can see and do, the invite email for each role, and that one customer's users can't reach another's data, with a test account per role."
url: https://proxymail.qa/use-cases/roles-and-permissions
---

1. [Home](https://proxymail.qa/)
2. [Use cases](https://proxymail.qa/use-cases)

# Testing roles and permissions

Permission bugs are the ones that leak data. Finding them means signing in as every role, including the ones you hope can't do much, and as a user from a different customer.

Updated October 13, 2026

## The accounts you need

| Account        | Role                           | What it checks                                                      |
| -------------- | ------------------------------ | ------------------------------------------------------------------- |
| Owner          | Created the workspace          | Billing, deleting the workspace and handing over ownership          |
| Admin          | Invited as an admin            | Managing people and settings, but not ownership                     |
| Editor         | Invited as an editor           | Creating and changing content, nothing about people or billing      |
| Viewer         | Invited as read-only           | Can look but not change anything, including through direct links    |
| Removed        | A member who was then removed  | Loses access at once, including in browsers already signed in       |
| Pending        | Invited, never accepted        | Can’t get in until accepting, and the invite expires when it should |
| Other customer | An admin in a second workspace | Can’t see or reach the first workspace’s data at all                |

## Set them up

1. **Create one address per role**: choose **Add account**, set **How many**, label the batch “Roles” and tick **Generate persona**.
2. **Sign up as the owner and invite the others** by email from your app, each with its role.
3. **Accept each invite** from its row: the invite email shows an **Accept invite** button. Set a password and save it on the address.
4. **Tag each address with its role** and note anything unusual, such as “Editor in workspace A only”.

## What to check

- **What each role sees:** only the menus, pages and buttons it should.
- **Hidden isn’t blocked:** signed in as the viewer, open an editor’s page directly by its link and try to save a change. Your app should refuse it, not just hide the button.
- **Role changes** take effect straight away, with an email if your app sends one.
- **Removed users and expired invites** can’t get back in, even with an old link.
- **Other customers:** the second workspace’s admin can’t reach the first one’s data by changing an id in a link.

## The emails to check

Invites, invite reminders, “your role changed”, “you were removed” and ownership transfer. Invite links usually work once: Proxy Mail QA never opens links itself, so the link still works when you click it.

Built your app with Base44? Its guide covers [roles in Base44 apps](https://proxymail.qa/built-with/base44). Use these accounts only on apps you build or are allowed to test, in development, staging or QA.

## Try it on your next sign-up test

Free plan, no credit card. Create an address and watch the code or link arrive.

[Create a free account](https://app.proxymail.qa/?mode=signup)

## Questions

### How do I give test accounts a role in my app?

Invite them from your app the way an admin would, using Proxy Mail QA addresses. Each invite arrives on its row with an Accept invite button. If your app has no invites, sign up with each address and set the role in your admin.

### How do I remember which account has which role?

Tag each address with its role and save its password on the address. The Accounts page filters by tag, so the viewer account is two clicks away.

### Should I test across customers too?

Yes, if your app has customers, teams or workspaces. Set up two, each with its own users, and check that nobody in one can see or change anything in the other.

## Related guides

- [Test age gates and age-restricted contentOne account per age band, from under 13 to turning 18 tomorrow, with parental consent emails and each date of birth noted.](https://proxymail.qa/use-cases/age-restricted-content)
- [Test content that depends on locationAn account per country for geo-blocked content, regional prices, tax and consent, and a traveller who crosses a border.](https://proxymail.qa/use-cases/location-based-content)
- [Test predictor game scoringA player for every scoring rule, with picks and expected points in the notes, so the leaderboard proves the rules work.](https://proxymail.qa/use-cases/predictor-games)
- [Test membership tiers and paywallsFree, trial, paid, top-tier and lapsed accounts, and every subscription email from welcome to payment failed.](https://proxymail.qa/use-cases/membership-tiers)
- [Test ticket ballots and prize drawsEnough entrants for some to win and some to lose, with priority members, duplicates, and a winner who never pays.](https://proxymail.qa/use-cases/ballots-and-prize-draws)
- [Test referral rewards and welcome offersReferrer, friends and first-time customers, plus the self-referral and repeat claims your rules should refuse.](https://proxymail.qa/use-cases/referrals-and-welcome-offers)
- [Test both sides of a marketplaceBuyer, seller, a second buyer and a moderator, so every order, message, refund and review email is checked from both ends.](https://proxymail.qa/use-cases/marketplaces)
- [Test email changes, lockouts and account deletionAn old and a new address for change of email, plus accounts to lock out, reset, protect with codes and delete.](https://proxymail.qa/use-cases/account-changes)
- [Test email preferences and unsubscribeAn account per preference setting, to prove opted-out users get nothing and unsubscribe works in one click.](https://proxymail.qa/use-cases/email-preferences)

[See every email testing problem we solve →](https://proxymail.qa/solve)