> ## Documentation Index
> Fetch the complete documentation index at: https://docs.draftt.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

Draftt uses role-based access control (RBAC) to determine what each user can see and do. Roles are assigned per user and control access to inventory data, governance policies, integrations, and settings.

## Built-in Roles

Draftt has three built-in roles covering the access patterns across engineering organizations.

| Role | Intended For |
| - | - |
| **Admin** | Organization administrators and platform leads. Full access to all platform capabilities including governance policies, and user management. |
| **Developer** | Engineering team members. Full visibility into inventory and governance data. Can create and manage integrations, policies, notification rules, and custom tags. Cannot modify platform configuration or manage users. |
| **Viewer** | Stakeholders, compliance reviewers, and observers. Read-only access to inventory and dashboards. No configuration capabilities. |

## Permission Matrix

| Category | Capability | Viewer | Developer | Admin |
| :- | :- | :-: | :-: | :-: |
| **Users** | View | X | V | V |
| **Users** | Invite | X | X | V |
| **Users** | Remove | X | X | V |
| **Users** | Assign Roles | X | X | V |
| **Settings** | View | V | V | V |
| **Settings** | Manage | X | X | V |
| **Assets** | View | V | V | V |
| **Assets** | Edit Metadata | X | V | V |
| **Upgrade Plans** | View | V | V | V |
| **Upgrade Plans** | Create | X | V | V |
| **Upgrade Plans** | Acknowledge / Resolve | X | V | V |
| **Policy** | View | V | V | V |
| **Policy** | Create | X | V | V |
| **Policy** | Edit | X | V | V |
| **Policy** | Delete | X | V | V |
| **Notifications** | View | V | V | V |
| **Notifications** | Create | X | V | V |
| **Notifications** | Edit | X | V | V |
| **Notifications** | Delete | X | V | V |
| **Integrations** | Add | X | V | V |
| **Integrations** | Configure | X | V | V |
| **Integrations** | Remove | X | V | V |
| **Analytics** | View | V | V | V |
| **Analytics** | Export | V | V | V |
| **Ticketing** | Create | V | V | V |
| **API Keys\*** | View | X | V | V |
| **API Keys\*** | Create | X | V | V |
| **API Keys\*** | Revoke | X | X | V |
| **API Keys\*** | Delete | X | X | V |

***

> **Note:** API key creation is restricted to the user's current role or below. For instance, a Developer can generate Developer-level keys but lacks the authorization to create Admin-level keys.

## Assigning Roles

### Manual Assignment

Go to **Settings > User Management > Users**. Find the user and select a role from the dropdown. Role changes take effect immediately. Active sessions are not interrupted but the new permissions apply on the user's next action.

### Via SCIM Group Mapping

When [SCIM Provisioning](/scim) is configured, roles are assigned automatically based on IdP group membership. See the [SCIM documentation](/scim) for group mapping configuration.

### Via SSO JIT

Users provisioned via Just-in-Time SSO receive the default role configured in **Account Settings > Configure SSO > JIT Configuration**. This is typically `Developer` or `Viewer`. Admins can update the role after provisioning.

## User Scope

A user's Scope is derived from CMDB records and IDP catalog data, defining exactly which resources they can access. While a Role governs the actions a user can perform within Draftt, the Scope establishes the boundaries of the resources they are permitted to manage.

## Next Steps

* Configure [SCIM Provisioning](/scim) to automate role assignment from your IdP
* Set [SSO](/sso) defaults for JIT-provisioned users


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.