# Role Permissions

> Settings > Licensing & Users > Role Permissions: pick a role, then allow or deny grouped capabilities; reset to default or save changes.

Source: https://totalshiftleft.ai/help-center/product-documentation/role-permissions

## Role Permissions

*Configure role-based access controls for the platform.*

You choose a **role** on the left, then enable or disable **permissions** for that role on the right. Changes apply after you save.

Where to find everything: [Administration Settings](/help-center/product-documentation/administration-settings).

## Layout

- **Roles** (left) — list of roles with a count of assigned permissions (for example **Administrator — 30 permissions**). Select one role to edit.  
- **Permissions** (right) — checkboxes grouped by capability area for the selected role.  

## Actions

- **Reset to default** — restore the selected role to built-in defaults.  
- **Save changes** — persist permission edits.  

## Permission groups (examples)

Exact labels vary by version; groups often include areas such as:

- **Test case management** — create, remove, modify, or view API test cases.  
- **Workflow management** — create or remove workflows, view details, approve or reject (where applicable).  
- **Test execution** — manual execution, view logs, trigger CI/CD integrations.  
- **Scheduling** — schedule runs, modify scheduled executions.  
- **Reporting** — view reports, export formats, analytics access.  
- **Environment management** — environment-related setup and maintenance.  

## How to assign safely

1. Start from **least privilege**.  
2. Add permissions by responsibility (builders vs operators vs read-only).  
3. Review assignments periodically.  
4. After edits, use **Save changes** before switching roles or leaving the page.  

## Default roles (typical)

| Role | Typical use |
|------|-------------|
| **Administrator** | Full platform administration |
| **Contributor** | Build and maintain tests in assigned scope |
| **Environment manager** | Environment configuration |
| **Reader** | View-only |
| **Reviewer** | Review or approve workflows where enabled |

Your deployment may show different or additional roles.

## Best practices

- Keep the administrator role small and monitored.  
- Use [Public API](/help-center/product-documentation/public-api) **allowed roles** together with RBAC for automation accounts.  
- Pair RBAC with [Audit Logs](/help-center/product-documentation/audit-logs).  

## Related articles

- [User Policies](/help-center/product-documentation/user-policies)
- [User Management](/help-center/product-documentation/user-management)