Fotowall ships with three roles: Admin, Moderator, and Viewer. We deliberately don’t ship a granular permission system — three roles cover ~95% of event-team configurations, and a granular system creates more confusion than it solves at this scale.
If you have a need a granular system would solve, talk to us. We’ve designed it twice and come away convinced the three-role model is the right tradeoff.
The three roles at a glance
| Admin | Moderator | Viewer | |
|---|---|---|---|
| See the wall and queue | Yes | Yes | Yes |
| Approve / reject photos | Yes | Yes | No |
| Pin / unpin photos | Yes | Yes | No |
| Delete photos | Yes | Yes | No |
| Change event settings | Yes | No | No |
| Create new events | Yes | No | No |
| Invite/remove team | Yes | No | No |
| See billing | Yes | No | No |
| Change billing | Yes | No | No |
Admin
Full access. Use sparingly.
A good rule: have at least two admins on every account (the primary event lead plus one backup), and no more than four. More than four admins means somebody is going to change billing or invite an outside contractor at exactly the wrong moment.
Admins can:
- Create new events.
- Edit any setting on any event.
- Invite, scope, and remove team members.
- See and change billing.
- See the full audit log across all events.
Admins cannot delete the audit log. The log is immutable by design — once an action is recorded, it stays recorded, even if the actor is later removed from the team.
Moderator
The role most of your team should have.
Moderators can:
- Approve, reject, pin, and delete photos on the events they have access to.
- See the wall in real time.
- See the event-scoped audit log (just for the events they have access to).
Moderators cannot:
- Create new events.
- Edit event settings (mode, branding, sponsor logos, welcome message).
- Invite or remove team members.
- See billing.
The Moderator role is the right fit for:
- The wedding planner.
- The DJ or band leader.
- The venue’s event lead.
- The night-of intern triaging the queue.
- Anyone you trust with the queue but not with billing.
Viewer
Read-only.
Viewers can:
- See the wall, the public gallery, and the moderation queue.
Viewers cannot:
- Take any action on photos.
- Change any setting.
The Viewer role is the right fit for:
- The bride’s parents, who want visibility but not the ability to accidentally reject.
- A sponsor’s marketing manager, who wants to confirm their logo is showing.
- A board member at a fundraising gala.
- Yourself when you’re checking the wall from a phone in a meeting — sometimes “no action possible” is the safest default.
How to choose
A decision tree for the common cases:
- Will this person make policy decisions on event night? → Admin.
- Will this person approve or delete photos? → Moderator.
- Will this person just watch? → Viewer.
If you’re not sure, default to Moderator. You can downgrade to Viewer later if they’re getting too click-happy.
What about the API role?
We’re piloting a fourth role for service accounts that drive integrations — read-only API access scoped to one event. If you’re a developer building on top of Fotowall, see API & integrations.
What to do next
- Invite team members to actually add them.
- Manage event access per user to scope properly.
- Audit log: who did what when so role decisions stay traceable.