--- title: "Roles and Permissions" description: "Look up what each organization and project role can do, and who can assign them." source: "Guardian Platform" --- ## About roles and permissions A role is the position a user is assigned within Guardian. Permissions are actions a user is granted based on their role. Key concepts and actions associated with roles and permissions include: - [Understanding roles](#understanding-roles) - [Understanding permissions](#understanding-permissions) - [Role and permissions matrix](#role-and-permissions-matrix) - [Managing user roles](#managing-user-roles) ## Understanding roles There are seven project and compliance roles in Guardian, each designed to support specific functions within your compliance workflow, plus an organization-level **Agent Operator** role for agent enrollment. | Role | Role Description | Typical Personas | | -------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | Organization Owner | Has full administrative access to the organization, including members, policies, agents, and all projects | _Chief Compliance Officer, VP of Engineering, Head of GRC_ | | Agent Operator | Can register agents with the gateway and view organization data | _Platform Engineer, DevOps Engineer, Fleet Operator_ | | Project Owner | Has full access to the project, including settings, members, policies, and indicators | _Engineering Manager, Product Manager, Compliance Manager_ | | Implementation Owner | Can create declarations and submit controls for review | _Senior Engineer, Tech Lead, Compliance Analyst_ | | Implementation Contributor | Can create declarations, but cannot submit controls for review | _Junior Engineer, Compliance Associate_ | | Audit Owner | Can comment on reviews, determine compliance outcomes, and manage policy credentials | _Head of Compliance, Chief Auditor, Internal Audit Director_ | | Audit Contributor | Can comment on reviews, but cannot determine compliance outcomes | _Junior Auditor, Internal Auditor, Compliance Reviewer_ | | Project Viewer | Can view project data, but cannot make changes | _Executive Stakeholder, External Auditor, Board Member_ | To see the roles you hold and what each one permits, open **Settings** → **Roles & Permissions**: ![The Roles & Permissions section of Settings, listing the Organization Owner role with its 28 permissions, then the Project Owner role with the projects it applies to.](../../../assets/roles-and-permissions/settings-roles.png) ## Understanding permissions | Permissions | Permissions Definition | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | Manage Organization Settings | Manage organization-wide settings and preferences | | Manage Organization Users | Add and remove users, and assign roles within the organization | | Register Agents | Register gateway agents under your account | | Create Agent Memberships | Associate a registered agent with a project | | View Agent Certifications | Read certifications and credentials of agents you operate or view | | Create Projects | Create projects within the organization | | Edit Project Settings | Edit project settings and export PDF reports | | Archive Projects | Archive projects within the organization | | Manage Project Members | Add and remove project members, and assign roles within the project | | Create Policies | Create or upload policies for the organization | | Apply Policies to Projects | Apply a policy to a project | | Archive Applied Policies | Archive policies applied to projects | | Create Credentials | Issue credentials for an applied policy | | Revoke Credentials | Revoke an issued credential for an applied policy | | Create Indicators | Create an indicator for a project | | Archive Indicators | Archive an indicator within a project | | Apply Indicators | Apply an indicator to an applied policy's control | | Activate Indicators | Activate applied indicators so they log evaluations | | Disable Indicators | Disable applied indicators so they do not log evaluations | | Run Indicators | Run indicators to receive and log evaluations | | Create Declarations | Submit a declaration to a control | | Submit Controls for Review | Submit a control as ready for review | | Determine Control Outcomes | Determine a control as Compliant, Non-compliant, or Not Applicable | | Create Comments | Submit a comment to a control | | View Project Data | View project data (read-only access) | | Manage Governance Programs | Create programs, assign their reviewers, and retry or revoke agent certifications, but never retry one for an assessment you started | | Submit Agent Assessments | Start, draft and submit assessments of the agents you can see, and read those agents for them; every member holds it | | Review Agent Assessments | Review assessments of the programs you're assigned to review, and retry or revoke the certifications your reviews issued; every member holds it | ## Role and permissions matrix Each role is composed of specific permissions as shown in the table below. A check (✅) indicates the role has this permission, while an X (❌) indicates it does not. | Permissions | Organization Owner | Project Owner | Implementation Owner | Implementation Contributor | Audit Owner | Audit Contributor | Project Viewer | | ---------------------------- | ------------------ | ------------- | -------------------- | -------------------------- | ----------- | ----------------- | -------------- | | Manage Organization Settings | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Manage Organization Users | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Register Agents | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Create Agent Memberships | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | View Agent Certifications | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Create Projects | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Edit Project Settings | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Archive Projects | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Manage Project Members | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Create Policies | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Apply Policies to Projects | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Archive Applied Policies | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Create Credentials | ✅ | ✅ | ❌ | ❌ | ✅ | ❌ | ❌ | | Revoke Credentials | ✅ | ✅ | ❌ | ❌ | ✅ | ❌ | ❌ | | Create Indicators | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Archive Indicators | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Apply Indicators | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Activate Indicators | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Disable Indicators | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Run Indicators | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | | Create Declarations | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | | Submit Controls for Review | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | | Determine Control Outcomes | ✅ | ✅ | ❌ | ❌ | ✅ | ❌ | ❌ | | Create Comments | ✅ | ✅ | ❌ | ❌ | ✅ | ✅ | ❌ | | View Project Data | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Manage Governance Programs | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | **Agent Operator** is assigned on the organization rather than on a project, so it is not a column in the matrix above. It grants **Register Agents**, **View Agent Certifications**, and **View Project Data**, so an operator can enroll agents, read the certifications of the agents they are bound to, and use Guardian. It does not grant **Create Agent Memberships** — associating an agent with a project stays with the Project Owner or Organization Owner. Organization Owners already have **Register Agents** and **View Agent Certifications**. Assign Agent Operator to people who should enroll agents without administering the organization. See [Register Agents](./register-agents.mdx). **Agent revocation.** **Revoke Agents** and **Restore Agents** also appear among the Organization Owner's permissions in **Settings**, but are left out of the tables above because no other role holds them. They cannot be assigned to another role, scoped to a project, or exercised by an API key. **Agent certification.** Every member of an organization holds **Submit Agent Assessments** and **Review Agent Assessments**, whatever their roles, so they can choose them as [API key](./api-keys.mdx#scopes) scopes. No role grants them, so they are left out of the matrix above and of the role cards in **Settings**. A member here is anyone with a role in the organization, Agent Operator or a project role included; they lose both with their last role there. Neither decides who works on an assessment: whoever started it drafts and submits it, and an Organization Owner assigns a program's reviewers. A reviewer's passing verdict issues the certification straight away only when they hold a role that can sign with the platform key: Audit Owner, Organization Owner, or Project Owner. See [Governance Programs](./governance-programs.mdx#assigning-reviewers). ## Managing user roles Assigning the right roles ensures users have appropriate access to perform their compliance work while maintaining security and separation of duties. Organization Owners can assign roles to all users across projects. Project Owners can only assign roles within projects they manage. For the steps, see [Member Management](./member-management.mdx). When assigning roles, consider: - **Separation of duties**: Implementation and audit roles are designed to maintain independence between those who implement controls and those who review them - **Junior team members**: Contributor roles allow junior staff to participate without actioning definitive compliance outcomes - **Multiple roles**: Users can be assigned multiple roles within a single project and/or across multiple projects ## Related - [Member Management](./member-management.mdx) — assign and change roles for organization and project members - [RBAC and Membership](../auth-service/rbac-and-membership.mdx) — the same roles as Auth Service enforces them, with access troubleshooting - [Register Agents](./register-agents.mdx) — enroll agents with the Agent Operator role or Register Agents permission - [API Keys](./api-keys.mdx) — limit a key's scopes to a subset of your permissions - [Settings](./settings.mdx) — see the roles you hold in the current organization - [Governance Programs](./governance-programs.mdx) — who creates programs and reviews agent assessments