> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> The built-in Admin, Manager, and Viewer roles, what each can do, and how to design custom roles in e6data.

A **role** is a named set of permissions. Users, groups, and service accounts are assigned one or more roles; the union of those permissions defines what they can do. For the underlying permission grammar, see [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane).

## Built-in roles

Every workspace ships with three built-in roles. Most organizations don't need anything else.

| Role | Typical user | What they can do |
| - | - | - |
| **Admin** | Organization owner, platform team | Full access to all workspace operations, including settings, access control, and version upgrades. |
| **Manager** | Data engineers, BI leads | Create and edit clusters and catalogs, run queries, and view the whole workspace - but not manage users, roles, or settings. |
| **Viewer** | Analysts, dashboard consumers | Run queries on assigned clusters and catalogs; no edit access. |

### What each built-in role can do

| Capability | Admin | Manager | Viewer |
| - | :-: | :-: | :-: |
| **Workspace** | | | |
| View workspace | ✅ | ✅ | ✅ |
| Edit workspace settings | ✅ | - | - |
| Suspend / resume workspace | ✅ | ✅ | - |
| Delete workspace | ✅ | - | - |
| **Catalogs** | | | |
| View catalogs | ✅ | ✅ | ✅ |
| Create / edit / refresh / delete catalog | ✅ | ✅ | - |
| **Clusters** | | | |
| View clusters | ✅ | ✅ | ✅ |
| Create / edit / suspend / delete cluster | ✅ | ✅ | - |
| **Queries** | | | |
| Run queries, view own history | ✅ | ✅ | ✅ |
| View all query history, cancel any query | ✅ | ✅ | - |
| **Access control** | | | |
| View users and roles | ✅ | ✅ | - |
| Invite/remove users, manage roles, manage service accounts | ✅ | - | - |
| **Settings** | | | |
| Configure SSO, trigger version upgrades | ✅ | - | - |
| Configure observability | ✅ | ✅ | - |

The complete, exhaustive permission list lives in the [Permissions matrix](/platform/reference/permissions-matrix) reference.

## Assigning roles

From the Console (Control Plane for org scope, or a workspace for compute scope):

1. Open **Access Control → Users** (or **Service Accounts**, or **Groups**).
2. Select the identity.
3. Click **Add role**.
4. Pick a role and a scope - workspace-wide, or limited to specific catalogs or clusters.
5. Save.

A user can hold different roles in different workspaces - for example, Admin in `dev` and Viewer in `prod`. Assigning roles to a [group](/platform/identity/users-groups-service-accounts) and managing membership is usually cleaner than per-user assignment.

## Group-to-role mapping via SSO

If you use [SSO](/platform/sso/setup), you can map IdP groups to e6data roles so users get the right role automatically on sign-in - no per-user assignment.

## See also

* [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane)
* [Permissions matrix](/platform/reference/permissions-matrix)
* [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.