Roster

See who can reach every board, and what to fix.

Roster is an Administration view for monday.com. It pulls together the access picture that monday shows across separate screens — board ownership, subscribers, team routes, and guest presence — into one list, with the risky patterns flagged.

What it does

Findings

  • Boards with too many owners
  • Boards owned by a dormant user
  • Guests present on a non-public board
  • Boards open to everyone on the account
  • Boards subscribed by the “everyone at account” team
  • Boards with no owner

Views

  • Board list — workspace, kind, permissions, owners, subscribers, guests, last update
  • People list — user type, teams, boards owned, boards subscribed, last activity
  • CSV export of all three (findings, boards, people)

What it does not do

  • It does not change permissions. Roster asks for read scopes only and holds no write access, by design: the fix belongs in monday's own administration screens, where the change is logged against the admin who made it.
  • It does not visualize or edit automations or workflows.
  • It does not reassign ownerless boards. That belongs to monday's own Administration → Board Ownership screen; Roster points you there.
  • It does not monitor continuously or keep a history. See below.

What it can see

Coverage limit

Even for an account admin, monday's API does not return private boards the admin is not a member of. There is no superuser token that reads every board on an account — a token reflects the same access as the person who owns it.

Roster can see: main (public) boards, shareable boards, and private boards the signed-in admin is personally a member of. It cannot see private boards outside that set, and it says so on screen rather than presenting a partial view as a complete one.

In practice this rarely hides the risky patterns above — everyone-permission boards, stray guests, and owner sprawl tend to live on public and shareable boards, which Roster does cover. A closed private board, by its nature, is already closed to everyone outside it.

Data

  • Roster stores nothing. Each time you open it, it queries the monday API, computes the view in your browser, and discards it when you close the tab.
  • No database, no server-side logs, no analytics on the data it reads.
  • CSV export happens entirely in your browser — the file never passes through a server we operate.
  • Full detail: privacy policy.