Use custom roles when a group needs more access than the default workspace settings. Keep the default workspace role conservative, then add narrowly scoped roles for publishing, advanced access, app access, and testing.
This article answers two questions for district IT and instructional technology teams:
- What custom roles should we create?
- How do we manage governance as usage grows across the district?
Default Workspace Role
Most teachers and staff should stay in the default workspace role. This role should support everyday teaching, planning, collaboration, and approved classroom workflows without giving every user district-wide publishing or advanced administrative permissions.
Recommended default settings to turn on:
- Create/manage own GPTs
- Use approved skills
- Users use approved projects and workspace settings
Recommended default settings to turn off:
- Workspace-wide GPT publishing is off for general users.
- External GPT publishing is off for general users.
- Third-party GPTs require owner approval.
Create These Custom Roles
Create a small set of custom roles that you are able to manage effectively to provide access to the right features for the right groups of people. Some examples of roles common in successful rollouts:
Purpose: Small group of trusted members to publish agents and GPTs for the district workspace.
| | |
| - Publish GPTs to workspace
| - Unrestricted third-party GPT access
|
Recommendation: This role prevents the workspace GPT directory from becoming crowded with one-off personal tools. Teachers can still create GPTs for themselves, while only approved publishers can place GPTs in front of the whole district. |
2. Skills Publishers
Purpose: Let a trusted group publish reusable skills across the workspace.
| |
- Curriculum Teams creating repeatable workflows
| - Publish or install skills for workspace
|
Recommendation: Skills should be tested individually before they are shared broadly. Publish only skills that solve repeatable district workflows, such as formatting district communications, converting reports into classroom resources, or applying approved templates. |
3. Advanced Access Pilot Group
Purpose: Give a limited group access to higher-credit or advanced features for evaluation and high-value workflows.
| Settings for role (choose what’s most appropriate) |
| - Turn on any advanced model access
|
Recommendation: Set a review date for the test role and determine whether default permissions need to change. Do not let pilot access become permanent by accident. |
Other Useful Roles
You may need more specialized role types beyond those above:
| | |
| Connected apps should be used only by a subset of users | - App Access - Google Drive Curriculum. - App Access - SharePoint Policy Library. - App Access - Box Operations. |
School/Department Publisher Groups | When schools or departments are maintaining local GPTs, agents, or skills | - High School GPT Publishers. - Curriculum Skills Publishers. - Student Support Agent Publisher |
Note for All Custom Roles
Custom roles do not inherit default workspace settings. Treat every custom role as a full permission set, not a small add-on. |
Checklist for custom roles:
- Mapped to a group (ideally SCIM-managed)
- Correct credit limit applied
- Keeps the permissions the user still needs
If a user belongs to multiple custom roles, the permissions can combine. For credit limits, the user receives the more generous limit.
