---
title: "Set portal roles, groups, and the permission ceiling"
description: "Decide what each portal user at a client can do with roles and groups, and cap what anyone at that client can ever do with the permission ceiling."
url: "https://support.outpostplatform.com/client-portal/roles-and-ceiling/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "MSP plan. Portal roles hold portal permissions only. Ready-made roles Owner (everything the ceiling allows, not editable), Billing, Approver, IT contact, Read only, plus custom roles and groups. Effective permissions are direct and group roles intersected with the client's permission ceiling. Lowering the ceiling rewrites no role. Client owners cannot grant beyond what they hold."
availability:
  plans: ["msp"]
  permission: "clientportal:users"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/roles-and-ceiling.md"
license: "CC BY 4.0"
---

# Set portal roles, groups, and the permission ceiling

Portal roles decide what each person at a client can do in the portal. The
permission ceiling decides the most that anyone at that client can do,
whatever their roles say. Use roles to fit the client's own people, and the
ceiling to keep the portal within what you have agreed to offer that client.

## Before you begin

- Editing roles and groups needs `clientportal:users`. Setting the ceiling
  needs `clientportal:manage`.
- For the full list of portal permissions, see
  [Client portal permissions](/client-portal/permissions/).

## How access is worked out

A person's permissions are every permission of every role they hold directly,
plus every role of every group they belong to, limited to what the client's
ceiling allows. Some permissions include others, such as **Pay invoices**,
which includes **View invoices and payments**.

The result is worked out on every request and never cached. A change to a
role, a group, or the ceiling applies to the person's next request.

## The ready-made roles

Every client starts with five roles:

| Role | For |
| --- | --- |
| **Owner** | Everything the ceiling allows, including people, roles, and remote access. It cannot be edited or deleted. |
| **Billing** | Invoices, payments, autopay, the next bill estimate, and quotes. |
| **Approver** | Accepting quotes and milestones, and answering approval requests. |
| **IT contact** | Tickets, devices, reports, remote access, and starter and leaver requests. |
| **Read only** | Seeing everything a read permission covers, and changing nothing. |

You can edit every ready-made role except **Owner**, but not delete them. You
can also add your own roles. Role names are unique per client.

## Edit a role

1. On the client's **Client portal** tab, select **Roles**.
2. Select a role to edit it, or **New role**.
3. Tick the permissions in the tree. Permissions the ceiling does not allow
   are shown as **Not allowed by the ceiling**.
4. Select **Save role** or **Create role**.

**Owner** shows **Everything the ceiling allows**. A role that holds more than
the ceiling allows shows the extra permissions under **Not allowed by the
ceiling**. They are kept on the role and given to nobody.

## Set the permission ceiling

The ceiling is per client. Nobody in that client's portal can do more than
it allows, whatever their roles grant.

1. On the client's **Client portal** tab, select **Permission ceiling**.
2. Choose one:
   - Turn on **No ceiling: allow every portal permission, including ones added
     in later releases**.
   - Turn it off and tick the permissions the client may use.
3. Before you save, **These roles hold more than this ceiling allows** lists
   each role the new ceiling would clip.
4. Select **Save ceiling**.

Lowering the ceiling rewrites no role. What a role holds above the ceiling is
shown grayed on **Roles**, and comes back if you raise the ceiling again. In
the portal, the client sees it as not allowed by your portal name.

Remote access has a ceiling of its own. See
[Let clients use remote access](/client-portal/remote-access/).

## What a client's owners can do

People with **Manage users and roles** can manage their own organization in
the portal, with these limits:

- They can create or edit a role only with permissions they hold themselves.
- They can give someone a role, or add them to a group, only when everything
  it grants is within their own permissions.
- They cannot change their own roles or groups, except to leave one.
- They cannot remove the last active owner.
- Every permission they save must be within your ceiling.

You are bound by the ceiling only.

## Verify

Select **View as** on a user on **Users**. It shows what they can do, what the
ceiling clips, and what nothing grants. See
[Invite and manage portal users](/client-portal/users/#see-what-a-user-can-do).

## Next steps

- [Client portal permissions](/client-portal/permissions/)
- [Let clients use remote access](/client-portal/remote-access/)