# Roles and permissions

> What each built-in role can do, permission by permission. Built from the same definitions the CMS checks.

Source: https://docs.bifrostorbit.com/cms/editors/roles-and-permissions/

Each person has a role in the organisation, and optionally a different one in a space. An organisation can change what a built-in role allows, and create roles of its own, in its **Roles** settings; this page shows the built-in defaults.

Roles of your own are part of the Growth and Enterprise plans. On Starter, the **Roles** page shows them locked and **New role** is switched off; built-in roles can still be adjusted. Roles created before a move to Starter keep working: they can still be given to people, renamed or deleted, but their permissions and rank stay as they are until an owner upgrades under Billing in Orbit.

## The roles

| Role | What it is for |
| --- | --- |
| Viewer | Read-only. Cannot create, edit or publish anything, and cannot see drafts. |
| Editor | Creates, edits and publishes content. |
| SEO Manager | Everything an editor can do, plus approving pages in review and the SEO settings. |
| Developer | Everything an editor can do, plus schemas, components, API keys and webhooks. |
| Administrator | Manages members, roles and every space in the organisation. |
| Owner | Full control, including deleting spaces and the organisation. |

## What each role can do

### API keys

- Create and revoke API keys and agent automation keys.: `apikey:manage` (Developer, Administrator, Owner)
- See the API keys.: `apikey:read` (Developer, Administrator, Owner)

### Audit trail

- Read the audit trail.: `audit:read` (Developer, Administrator, Owner)

### Brand

- Change locked brand components and approve the Brand step.: `brand:manage` (Administrator, Owner)

### Campaigns

- Create and change landing pages and banners.: `campaigns:manage` (Editor, SEO Manager, Developer, Administrator, Owner)

### Claims

- Delete claims and disclaimers for good.: `claims:delete` (Administrator, Owner)
- Write and change the approved claims and disclaimers.: `claims:manage` (SEO Manager, Administrator, Owner)

### Content

- Approve or send back pages in review.: `content:approve` (SEO Manager, Administrator, Owner)
- Copy pages to another region or language.: `content:copy` (Editor, SEO Manager, Developer, Administrator, Owner)
- Create pages and entries.: `content:create` (Editor, SEO Manager, Developer, Administrator, Owner)
- Move pages and entries to the bin, and restore them.: `content:delete` (Editor, SEO Manager, Developer, Administrator, Owner)
- Publish pages, schedule them and promote them to another environment.: `content:publish` (Editor, SEO Manager, Developer, Administrator, Owner)
- Erase trashed pages for good. Kept for owners.: `content:purge` (Owner)
- See live content.: `content:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)
- See drafts and unpublished changes.: `content:read_draft` (Editor, SEO Manager, Developer, Administrator, Owner)
- Go back to an earlier version of a page.: `content:rollback` (Editor, SEO Manager, Developer, Administrator, Owner)
- Take pages offline.: `content:unpublish` (Editor, SEO Manager, Developer, Administrator, Owner)
- Edit pages and entries, and send them for review.: `content:update` (Editor, SEO Manager, Developer, Administrator, Owner)

### Website addresses

- Add and verify website addresses.: `domain:manage` (Developer, Administrator, Owner)
- See the website addresses.: `domain:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Emergency banners

- Publish a banner on every page at once, without review, in an emergency.: `emergency:publish` (Administrator, Owner)

### Environments

- Create and change environments.: `environment:manage` (Developer, Administrator, Owner)
- See the environments, such as Staging and Production.: `environment:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Languages

- Add and change languages and their fallbacks.: `locale:manage` (Developer, Administrator, Owner)
- See the languages.: `locale:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Media

- Move files to the bin.: `media:delete` (Editor, SEO Manager, Developer, Administrator, Owner)
- See the media library.: `media:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)
- Upload files and change their details.: `media:upload` (Editor, SEO Manager, Developer, Administrator, Owner)

### People

- Add people to the organisation.: `member:invite` (Administrator, Owner)
- See who is in the organisation.: `member:read` (Administrator, Owner)
- Take someone out of the organisation.: `member:remove` (Administrator, Owner)
- Change someone's role or the regions they can work in.: `member:update` (Administrator, Owner)

### Menus

- Change the menus.: `navigation:manage` (Editor, SEO Manager, Developer, Administrator, Owner)
- See the menus.: `navigation:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Organisation

- Delete the whole organisation.: `organisation:delete` (Owner)
- See the organisation and its spaces.: `organisation:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)
- Change the organisation's name, logo and settings, and switch AI agents on or off for it.: `organisation:update` (Administrator, Owner)

### Popups

- Create and change popups.: `popups:manage` (Editor, SEO Manager, Developer, Administrator, Owner)

### Prices

- Change fields set to protect a price, such as prices and was prices.: `pricing:manage` (Editor, SEO Manager, Developer, Administrator, Owner)

### Promotions

- Change fields set to protect a promotion, such as promo codes and discounts.: `promotions:manage` (Editor, SEO Manager, Developer, Administrator, Owner)

### Redirects

- Create and change redirects.: `redirect:manage` (Editor, SEO Manager, Developer, Administrator, Owner)
- Put redirects live.: `redirect:publish` (Editor, SEO Manager, Developer, Administrator, Owner)
- See redirects and the addresses visitors could not find.: `redirect:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Regions

- Create and change regions, their time zone and address prefix.: `region:manage` (Developer, Administrator, Owner)
- See the regions.: `region:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Releases

- Delete releases.: `release:delete` (Administrator, Owner)
- Create releases and add pages to them.: `release:manage` (Editor, SEO Manager, Developer, Administrator, Owner)
- Publish releases or schedule them.: `release:publish` (Editor, SEO Manager, Developer, Administrator, Owner)
- See releases.: `release:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### Roles

- Create roles and change what roles allow. Kept for owners.: `role:manage` (Administrator, Owner)
- See the roles and what each allows.: `role:read` (Developer, Administrator, Owner)

### Schema

- Create and change content types, components and taxonomies.: `schema:manage` (Developer, Administrator, Owner)
- See content types and components.: `schema:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)

### SEO

- Change the website's SEO settings and work on SEO issues.: `seo:manage` (SEO Manager, Developer, Administrator, Owner)

### Spaces

- Reach every space without being added to each one.: `space:access_all` (Administrator, Owner)
- Copy a space with its schema and content.: `space:clone` (Administrator, Owner)
- Create a new space.: `space:create` (Administrator, Owner)
- Move a space to the bin.: `space:delete` (Owner)
- Add and remove people on a space.: `space:member_manage` (Administrator, Owner)
- Erase a trashed space for good.: `space:purge` (Owner)
- Open a space.: `space:read` (Viewer, Editor, SEO Manager, Developer, Administrator, Owner)
- Change a space's name, logo and settings.: `space:update` (Administrator, Owner)

### Webhooks

- Create, change and test webhooks.: `webhook:manage` (Developer, Administrator, Owner)
- See webhooks.: `webhook:read` (Developer, Administrator, Owner)

## Limits that apply on top

- **Regions:** someone limited to some regions can read every region but only change those.
- **AI agents:** an agent never has more than its own short list of drafting permissions, whatever the person behind it may do.
- **Production:** agents stay out of Production unless an Administrator allows it.