# Roles and permissions
Source: https://docs.infraista.com/en/account/roles-and-permissions



Every member of an organization has one **role**. A role is a set of **permissions**: one switch for
each action on each page of the console, such as viewing servers, restarting them or paying invoices.

## Built-in roles [#built-in-roles]

| Role          | Can do                                                                                 |
| ------------- | -------------------------------------------------------------------------------------- |
| **Owner**     | Full control, including billing, members and closing the organization. Can't be edited |
| **Admin**     | Manage every resource, member and setting, including billing                           |
| **Developer** | Create, run and delete resources. No billing or member management                      |
| **Billing**   | Invoices, payment methods, budgets and credits. Read-only on resources                 |
| **Viewer**    | Read-only access to resources. Can't change anything                                   |

An organization can have several Owners. You pick a role when you
[invite someone](/en/account/invite-teammates) and can change it at any time.

## See or adjust a role [#see-or-adjust-a-role]

Go to **Settings › Roles & permissions** and select a role on the left.

<Shot name="account/roles/roles" alt="Settings, Roles and permissions: built-in and custom roles on the left and the Admin role's permissions grouped by product" />

* Permissions are grouped by product (**Compute**, **Data & Storage**, **Account** and so on). Select
  a product to expand it and see each action; the count shows how many are on.
* **Search permissions** finds an action by name, and **Only what this role can do** hides the rest.
* **Members with this role** lists who has it. Pick someone and select **Assign** to give them this
  role.

You can change what **Admin**, **Developer**, **Billing** and **Viewer** allow in your organization.
Changes apply to everyone with that role here. **Reset to default** brings back what Infraista ships.

## Create a custom role [#create-a-custom-role]

Custom roles grant exactly what someone needs, for example "restart servers but no billing".

1. Select **Create custom role**, or open a built-in role and select **Duplicate as custom role** to
   start from it.
2. Give it a **Name** and a short **Description**.
3. Tick the permissions it should have. Some actions need another one to make sense (for example,
   restarting servers needs seeing them); those are ticked for you.
4. Select **Save role**.

An organization can have up to 25 custom roles. Assign one from **Members with this role** or from
**Settings › Team**.

## When someone needs more access [#when-someone-needs-more-access]

A member who hits something their role doesn't allow sees what's missing and can **Request access**. Their
request comes to the Owners and Admins; see [Access requests](/en/account/access-requests).

## Related [#related]

* [Invite teammates](/en/account/invite-teammates)
* [Access requests](/en/account/access-requests)