> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > Assign Tracecat's built-in roles to users at the organization or workspace level, and understand how assignments compute each user's effective permissions. ## Overview A scope is one permission on one resource, named `resource:action`, and a role bundles scopes. You assign a role to a user or a group either organization-wide or for a single workspace, and Tracecat computes each user's effective permissions from those assignments. ## Built-in roles Tracecat seeds six built-in roles into every organization at startup. Tracecat rejects changes to a built-in role's scopes and rejects deleting it, so create a custom role when the built-in set does not fit. | Role | Level | What it can do | Scopes | | --------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | `workspace-viewer` | Workspace | Read workflows, integrations, cases, tables, schedules, agents, secrets, tags, variables, the inbox, the workspace, and its member list. | 12 | | `workspace-editor` | Workspace | Everything `workspace-viewer` can, plus create and update those resources, run workflows, agents, and any action, terminate workflow runs, and run workflow sync and workspace sync. | 36 | | `workspace-admin` | Workspace | Everything `workspace-editor` can, plus delete those resources, update or delete the workspace, invite, update, and remove members, and manage workspace service accounts. | 56 | | `organization-member` | Organization | Read the organization, its member list, the registry, and organization secrets, and read and run agents. | 6 | | `organization-admin` | Organization | Everything `workspace-admin` can in every workspace, plus create workspaces, manage organization settings, members and invitations, roles, groups, and assignments, organization service accounts, the custom registry, and organization secrets, and read billing. | 84 | | `organization-owner` | Organization | Everything `organization-admin` can, plus `org:delete`, `org:billing:update`, and `org:owner:assign`. | 87 | The Scopes column counts the current definition. Startup seeding adds scopes a built-in role is missing and removes none, so an organization created before a scope was renamed also keeps the old name. `organization-owner` and `organization-admin` reach every workspace in the organization without a workspace membership. Every other user needs a workspace membership plus a workspace role, and `organization-member` on its own grants no workspace resource scope. Built-in roles ## Assignments An assignment binds one role to one user or one group, either organization-wide or for a single workspace. An organization-wide assignment applies in every workspace, and a workspace assignment grants nothing outside that workspace. A user's effective scopes are the union of their direct assignments and the assignments of every group they belong to. A user with `workspace-viewer` directly and a group assignment of `workspace-editor` in the same workspace holds every `workspace-editor` scope there. Each user holds at most one direct assignment per workspace and at most one organization-wide direct assignment, and the same limit applies to each group. Tracecat refuses a second assignment for the same user and workspace with `User already has an assignment for this workspace`, and for the same group with `Group already has an assignment for this workspace` — change the role on the existing assignment instead. You can assign a role only when you hold every scope in it, and platform superusers are exempt from this rule. Tracecat refuses an assignment whose role carries a scope you lack, or adding a user to a group whose roles carry one, with `Cannot grant scopes not held by the caller`. You change a member's role on the workspace Members page at `/workspaces/{id}/members`, which writes a workspace-scoped user assignment for that member. Without the `rbac_addons` entitlement you manage access with built-in roles from the organization Members page and the workspace Members page. See [Custom roles and groups](/manage-platform/custom-roles) for custom roles, groups, and scopes. ## Organization membership A role assignment applies only to a user who is a member of the organization, and Tracecat rejects assigning a role or a group to a user without membership with `User not found in organization`. A signed-in user without an organization membership sees `No organization access yet` instead of their workspaces, with any pending invitations listed. Registration and sign-in without an invitation create no membership. On a single-tenant deployment, registration or sign-in enrolls a superuser into the default organization and repairs the organization-wide role of an existing member. An account that holds no membership needs an invitation or provisioning before it can open a workspace. An accepted organization invitation creates the membership and an organization-wide assignment of the invited role. An accepted workspace invitation creates the organization membership with `organization-member` when the user has none, then the workspace membership. See [User management](/manage-platform/users) for invitations. ## Related pages * See [User management](/manage-platform/users) for registration, invitations, and organization membership. * See [Custom roles and groups](/manage-platform/custom-roles) for custom roles, groups, custom scopes, and assignment management on the Access control page. * See [Service accounts](/manage-platform/service-accounts) for machine identities that hold scopes directly, with no role. * See [Architecture](/security/architecture#role-based-access-control) for how RBAC fits the identity and trust model. * See [Organization audit logs](/audit-logs/organization) for the `rbac_role`, `rbac_group`, `rbac_assignment`, and `rbac_user_assignment` events.