Products

What you start with

A new workspace has six products switched on: Ranking, Members, Staff, Roles, API keys and Payouts. They are the parts a Roblox group needs to be run at all: change a rank, see who is in the group, keep a record of your team, decide what that team may do, hold the credentials that connect it to Roblox, and pay them.

ranking    ranking.view
members    members.view
staff      staff.view
roles      staff.view
keys       ranking.run
payouts    payouts.view

Five of the six are not privileged after the first day. Each can be removed, and a group that pays nobody should not carry a Payouts tab forever. The floor is one product: API keys is required and stays whatever else you remove.

Adding a product

The Add a product button sits at the bottom of the sidebar, under the products you already have and under Settings. It opens the catalogue: categories down the left, with a count of how many in each are on, and the products in the chosen category on the right. Adding is one click, and so is removing.

Reading the catalogue needs members.view. Actually adding or removing one needs workspace.manage, because it changes what the whole team sees rather than what one person sees, and the picker says so rather than silently doing nothing. Both directions are written to the audit log, as workspace.module_enabled and workspace.module_disabled, with the name of whoever clicked.

Switching one off

Switching a product off hides its surface and nothing else. The entry leaves the sidebar and its page answers with a short notice instead of its contents. What is underneath keeps running.

The audit log is still written for every privileged action whether or not the Audit log page is on: switching it off hides the view, never the evidence. The sweep still runs with Reconciliation off, still mirrors ranks and still detects drift. Game servers keep reporting with Activity off, so nothing is lost while it is off and the numbers are there when you turn it back on.

Only what you can open

Every entry in the catalogue names the permission its own page requires, and you can only add a product you could already open. Enabling is therefore never a way to widen your own access: the most it can do is put a door in the sidebar that you already had the key to.

A product you lack the permission for is still listed, shown locked with the permission named, so the answer is needs activity.view rather than a gap where a product used to be. The check is not only in the browser: the server refuses the same request and says which permission it was missing.

Removing is not held to the same test. Taking away a page you cannot see is still tidying up, and workspace.manage was already required to be in the picker at all.

One product is the exception in the other direction. API keys is marked required and cannot be switched off by anybody, owner included. Issued keys keep authenticating whether or not their page is on, so removing the page would take away the only way to notice a key had leaked and the only way to revoke it, while leaving the leak itself working. A switch that can disable your own ability to respond to a compromise is not a preference, so it is not offered as one.

The full catalogue

Every product, the category it appears under, the permission its page requires, and whether a new workspace starts with it. Always in the last column means required: on for every workspace, and not removable.