A role is a set of permissions. It decides **what** a user can do in your organization: for example view targets, start scans, or invite new members. You can use the two built-in roles, or create your own roles with exactly the permissions you need.

Roles work together with labels. A role decides what a user can do, and a label decides which targets the user can see. See [Restrict user access with labels](https://help.catcher24.com/hc/help-centre/articles/1790938316-restrict-user-access-with-labels).

## Open the roles

In the left-hand menu, under **Organization Management**, click **Roles**.

The list shows every role and whether it is **All Inclusive**. Use the search box to find a role, or click the **Name** column header to sort. Each role has buttons at the end of its row:

* **Clone** (blue): create a copy of the role as a starting point for a new role.

* **Edit** (orange): change the name and permissions of a role.

* **Delete** (red): delete the role.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBldz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--d8d40ea3ca5f0011055765cd31c6723b6bb759ba/roles-overview.jpg)

## The built-in roles

Every organization has two roles:

| Role       | What it can do                                                                                                                        | Can you change it?               |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
| **admin**  | All possible permissions.                                                                                                             | No. You can only clone it.       |
| **member** | All permissions, except: delete the organization, create and delete invitations, delete members, and create, update and delete roles. | Yes. You can edit and delete it. |

## All inclusive roles and excluded permissions

When you create or edit a role, you build it in one of two ways:

* **Choose what the role can do.** Leave **All Inclusive** unticked. The list is called **Granted Permissions**, and the role can only do what you tick.

* **Choose what the role can not do.** Tick **All Inclusive (Contains all possible permissions)**. The list changes to **Excluded Permissions**, and the role can do everything except what you tick. New permissions that are added to the product later are included automatically.

Use the first method for a restricted role, such as someone who only starts scans. Use the second method for a role that is almost an admin.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBmQT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--d21d184094a92ea07c4e002bbaa5ef825368907e/roles-clone-all-inclusive.jpg)

## Always enable these two permissions

Whichever way you build a role, make sure it includes these permissions. Without them, users run into an empty or unavailable environment.

| Permission             | Section                 | Why                                                                                          |
| ---------------------- | ----------------------- | -------------------------------------------------------------------------------------------- |
| **View Organizations** | Organization Management | Required to see the organization at all. Without it, the user can not open the organization. |
| **View Dashboard**     | Reporting > Dashboards  | Required to see the default dashboard.                                                       |

Add them to every role you create, also to roles that only need a small set of permissions. If you build a role with **All Inclusive** ticked, make sure you do not tick these two in the **Excluded Permissions** list.

## Create a role

1. Go to **Organization Management > Roles** and click **New Role**.

2. Enter a **Role Name**. This field is required.

3. Choose how to build the role: leave **All Inclusive** unticked to grant permissions, or tick it to exclude permissions.

4. Tick the permissions. Always include **View Organizations** and **View Dashboard**. Every permission has a short description underneath. Tick the box next to a section name to tick all permissions in that section, and click the minus button next to a section to collapse it.

5. Scroll down and click **Save**.

The new role appears in the list. A role you build by granting permissions shows **No** in the **All Inclusive** column.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBmUT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--544937b88327b5e7a34772e0f0d0c2907a815303/roles-create-dialog.jpg)

### Example: a role that can only start and cancel scans

Name: `Scan operator`

* **Organization Management:** View Organizations (always include this)

* **Reporting > Dashboards:** View Dashboard (always include this)

* **Targets:** View Targets

* **Vulnerability Management:** View Vulnerabilities

* **Scans & Runners:** View Scans, Start Scans, Cancel Scans

A user with this role can see targets and findings, and start and cancel scans, but can not change targets, members or settings.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBWHM9IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--a77ae68b32d809d48be5a9d1769050fe7816f92f/roles-create-dialog.jpg)

## Give a role to a user or a group

You can assign roles in two places:

* **Directly to a member:** go to **Members**, and in the **Roles** column of the user, click the role field and tick one or more roles.

* **Through a group:** go to **Groups**, and in the **Roles** column of the group, pick a role. Members of the group get this role. See [Manage user groups](https://help.catcher24.com/hc/help-centre/articles/1790938434-manage-user-groups).

Your own roles also show up in these lists as soon as you create them.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBmdz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--f9fa862158aaf9704503231aa7f833ddd81c12f5/members-roles-dropdown.jpg)

## Permission reference

Permissions are grouped in sections. Most sections have *View* permissions to see things, and other permissions to change them.

### Organization Management

| Section           | Permissions                                                                                                       |
| ----------------- | ----------------------------------------------------------------------------------------------------------------- |
| **Organizations** | View Organizations, Update Organizations, Delete Organizations                                                    |
| **Groups**        | View, Create, Update and Delete Organizations Groups                                                              |
| **Invitations**   | View, Create and Delete Organizations Invitations                                                                 |
| **Members**       | View Organizations Members, Delete Organizations Members, Assign Organizations Members (assign labels to members) |
| **Roles**         | View, Create, Update, Delete and Assign Organizations Roles                                                       |
| **Settings**      | View Organizations Settings, Update Organizations Settings (for example email, Slack and Teams notifications)     |

### Targets and scans

| Section             | Permissions                                                                                    |
| ------------------- | ---------------------------------------------------------------------------------------------- |
| **Targets**         | View Targets, Create Targets, Update Targets, Delete Targets (request the deletion of targets) |
| **Labels**          | View, Create, Update, Delete and Assign Label                                                  |
| **Scans & Runners** | View Scans, Start Scans, Cancel Scans, View Scans Runner, View Scanner                         |
| **Certificates**    | View Certificates                                                                              |
| **Dns**             | View Dns                                                                                       |
| **Endpoints**       | View Endpoints                                                                                 |

### Vulnerability Management

| Section              | Permissions                                                                                             |
| -------------------- | ------------------------------------------------------------------------------------------------------- |
| **Vulnerabilities**  | View Vulnerabilities, Silence Vulnerabilities, Unsilence Vulnerabilities, View Silenced Vulnerabilities |
| **Occurrences**      | View, Silence and Unsilence Vulnerability Occurrences                                                   |
| **Detections**       | View Detection, Silence Detection, Unsilence Detection                                                  |
| **Asset Management** | View Assets Product, View Assets Vendor, View Assets Version                                            |

### Reporting and audit

| Section        | Permissions                                                                                                                          |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **Dashboards** | View, Create, Update and Delete Dashboard                                                                                            |
| **Audit-Logs** | View Audit Logs. See [Audit log](https://help.catcher24.com/hc/help-centre/articles/1790939261-audit-log-see-who-did-what-and-when). |

### Integrations

| Section                 | Permissions              |
| ----------------------- | ------------------------ |
| **ESET Integration**    | View ESET Integration    |
| **Phished Integration** | View Phished Integration |
| **UniFi Integration**   | View UniFi Integration   |

### Payment and subscription

| Section                        | Permissions                                                  |
| ------------------------------ | ------------------------------------------------------------ |
| **Invoices**                   | View Organizations Invoices                                  |
| **Organization Subscriptions** | View, Update, Cancel and Onboard Organizations Subscriptions |

## Tips

* Always enable **View Organizations** and **View Dashboard** in every role.

* Start from a clone of `member` or `admin` when the new role is close to one of them. It saves ticking every permission.

* Give people only what they need. Prefer a restricted role over `admin`.

* Combine roles and labels: a partner can have the `Scan operator` role and a label that limits them to their own targets.