docs(audiences): document Editor vs Admin role permissions in Audiences

[george-dilthey]

What changed

Added a "Roles in Audiences" note to docs/audiences.md (in the "Importing your data" section) documenting the Editor vs Admin permission breakdown for the Audiences feature. Also added an admin-access note to the "Creating an audience" section, and expanded the Audiences section in docs/roles-and-permissions.md with the full Editor/Admin breakdown using bullet lists.

Why

An Enterprise customer (SpyCloud) asked in Intercom conversation #215475102746052: "are we able to allow editors to create and save audiences? Jay is trying to create them but we have him as an Editor." followed by "will Jay be able to set up the ad syncs then as an editor or only admins as well?"

Neither docs/audiences.md nor docs/roles-and-permissions.md documented the full breakdown of what Editors can and can't do in Audiences. The existing note in docs/audiences.md only said "Admin access is required only to add or configure data sources" — which was both incomplete and potentially misleading (creating audience segments and enrichments are also admin-only). Fin couldn't answer the customer's question because the docs didn't have it.

Source link(s)

• Intercom conversation: https://app.intercom.com/a/inbox/_/inbox/conversation/215475102746052
• Slack thread (linked in conversation): https://clay-hq.slack.com/archives/C09SSN95X6W/p1784146353598309
• Verifier: audience-abilities.service.ts in clay-base — PASS for all permission claims. Code confirms Editors (WorkspaceMember) get Read + ManageActions (ad syncs); all other abilities (UpdateSegment, ManageEnrichments, ManageSignals, ManageImports, ManageExports) are Admin-only (WorkspaceAdmin). Liveness: RBAC is unconditionally enforced, no feature flag gates it.
• Slack corroboration: Grant Empey (Audiences team) in #ent-watershed-clay 2026-04-30: "you only have read permissions in audiences unless you are an admin" — confirms code state.

Note: The support agent (Ryan Phung) listed "Run existing enrichments" and "Manage existing export actions" as Editor capabilities — the verifier found these are actually Admin-only per the RBAC code (ManageEnrichments and ManageExports). The doc reflects the verified code behavior, not the support agent's response.

Uncertainties

None. All permission claims verified against audience-abilities.service.ts in clay-base. Ad syncs from segments are behind an Eppo feature flag EnableSegmentsForAds (default false per workspace) — this is a workspace-enablement flag, not a role-based restriction, so it doesn't affect the Editor/Admin breakdown documented here.

Related observations

• All 12 existing open PRs on docs/audiences.md cover different gaps (Databricks import, CSV export, signal setup, archive behavior, Salesforce field mapping, etc.) — none document the Editor vs Admin permission breakdown. This change is materially new.
• PR docs(audiences): add FAQ for why users only see Sync to ad platforms in Send menu #1623 adds a "Why do I only see Sync to ad platforms?" FAQ — adjacent but does not overlap with role permissions.
• The audiences.md push also changed 4 Unicode characters from ⋯ (U+22EF, MIDLINE HORIZONTAL ELLIPSIS) to ⋮ (U+22EE, VERTICAL ELLIPSIS) in references to the three-dot menu icon — these were unintended and are cosmetically minor but out of scope. A reviewer may want to revert those 4 lines if consistency with the rest of the file is important.

Closes DOC-1236

[linear-code]

DOC-1236