Manage roles and permissions
Roles group the operations people can perform. Review a role's actual permissions before assigning it, and remember that changing a shared role affects every account holding it.
Access needed
Access depends on your assigned permissions and workflow scope.
- Read roles and the permission catalogue
identity.roles.readReading does not grant role changes.
Role and permission labels
Typical responsibility: Authorized access administrator. Role names alone do not grant access.
- Read roles and the permission catalogue
- Create a role or edit its permission selections
- All:
identity.roles.readidentity.roles.manageCatalogue reads and role writes are separate requirements. Built-in protections still apply.
Role and permission labels
Typical responsibility: Authorized access administrator. Role names alone do not grant access.
- Read roles and the permission catalogue
- Manage role definitions and permissions
- Rename a custom role, restore defaults or delete an unused custom role
identity.roles.manageOpening the Roles interface additionally needs identity.roles.read. Deletion requires zero assigned users; restoration is only for customized built-in roles.
Role and permission labels
Typical responsibility: Authorized access administrator. Role names alone do not grant access.
- Manage role definitions and permissions
- Assign or remove roles on a person
- All:
identity.users.manageidentity.roles.readAccount assignments are separate from role definitions. Last-role and administrator protections still apply.
Role and permission labels
Typical responsibility: Authorized access administrator. Role names alone do not grant access.
- Manage workspace user accounts and assignments
- Read roles and the permission catalogue
Demo screenshots may show broader access than your account.
Review the existing roles
Open Access Control → Roles. Search for a role and review Type, Users, Permissions and Configuration. Open its name to inspect Details, or its permission count to inspect access.
| Role type | What you can change |
|---|---|
| Built-in | Names and descriptions are fixed. Permissions can be customized except for Tenant administrator. Built-in roles cannot be deleted. |
| Custom | Name, description and permissions can be maintained. Deletion requires no assigned users. |
| Tenant administrator | Its permissions are protected and cannot be edited. |
A familiar role name is not a guarantee of unchanged access. Check its current selections and whether its configuration is customized. Positions and reporting relationships are separate from access roles.
Prepare a custom role
- Define the work first
Identify the operations the person needs and check the relevant guides' Access needed sections. Separate viewing, editing and approval duties.
- Enter the role details
Select Create role. Enter a unique Display name of 1–64 characters and an optional Description of up to 256 characters. Choose a clear responsibility rather than an individual's name.
- Select the required operations
Search permissions or expand a module. Read each description before selecting it. Review the selected count; selecting an entire group can include operations beyond the intended task.
- Review, create and verify
Review the complete selection, then select Create role. Check the result and reopen the role to verify the saved name and permissions. Creating a role does not assign it to any account.
The screenshot shows an unsaved Attendance reviewer example with View attendance selected. It illustrates a narrow reading responsibility, not a recommended permission bundle for every attendance task. The draft was discarded.
Change permissions on an existing role
Open the role and select Permissions. Expand the relevant module, review the selected operations and make the intended changes. Review all selections before Save permissions, then reopen the role to verify the saved result.
Use the Permissions catalogue to read operation descriptions across modules. It explains available access but does not assign it. See Manage users and employee links to assign an existing role to a person.
Rename, restore or remove
Custom-role name and description changes do not change existing assignments. Review the role's Details and available actions before editing its description or display name.
Restore defaults, when offered for a customized built-in role, replaces that role's customized permissions with the built-in defaults. It does not preserve selected exceptions and does not apply to custom roles. Review affected users and the resulting access before confirming.
Check when changes take effect
Permission and assignment changes reach workspace services, while the person's session updates on refresh, documented within 15 minutes. An authorized user administrator can end sessions when a fresh sign-in is required, which interrupts the affected person's work. The timing was not measured in this review.
Troubleshooting
| Problem | What to check |
|---|---|
| Role name is rejected | Use a unique name within the documented length and avoid built-in names. |
| Role cannot be deleted | Check whether it is built-in or still assigned to users. |
| Restore defaults is unavailable | Only customized built-in roles have built-in defaults to restore. |
| A person still has removed access | Inspect their other roles and refresh the session. |
| Permissions can be viewed but not saved | Reading and managing roles require different permissions. |
| Creating another custom role fails | Check the workspace's custom-role limit and the displayed error. |
What was verified
The live Roles list, existing role Permissions tab and Permissions catalogue were inspected. A custom-role draft was prepared and discarded without creation. No role was saved, restored, deleted or assigned. Restricted-account behavior and change propagation were not tested.