---
title: "Manage roles"
description: "Create, clone, edit, and delete console roles, restore a built-in role's defaults, and change which roles a person holds."
url: "https://support.outpostplatform.com/depot/manage-roles/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Settings > Roles: create a role from nothing or from another role, clone, edit permissions grouped by area and review the added and removed list before saving, restore a built-in role's defaults, and delete a custom role nobody holds. Owner always holds every permission. Non-owners cannot grant permissions or roles beyond their own. Change a person's roles on Team."
availability:
  plans: ["essentials", "enterprise", "msp"]
  permission: "role:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/manage-roles.md"
license: "CC BY 4.0"
---

# Manage roles

A role is a named set of permissions, and each person in the console holds one
or more roles. This page shows how to create and change roles, and how to
change which roles a person holds, so each technician has the access their job
needs and no more. For the roles every Outpost comes with, see
[Roles and permissions](/depot/roles-and-permissions/).

## Before you begin

- You need `role:manage`. Among the built-in roles, only **Owner** holds it.
- Home Lab has one console user, the owner, and no roles. Changing roles there
  is refused with **Plan limit reached**.
- A change to a role applies to everyone who holds it from their next request.
  Removing a permission takes it away from all of them at once.
- On the MSP plan, roles belong to your practice's team, and you manage them
  from the practice, not from a client.

## What you can change {#rules}

- **Owner** always holds every permission and cannot be changed in any way:
  not renamed, narrowed, restored, or deleted. Your Outpost always has someone
  who can undo a change.
- The other built-in roles (Support Manager, Field Technician, Support Rep,
  and Accounting) can be edited, and each has **Restore defaults**. They
  cannot be deleted.
- Custom roles can be created, cloned, edited, and deleted, and have no
  **Restore defaults**. **Sales** and **Project manager** come with every
  Outpost and are custom roles. A role's code is set from its name when you
  create it and does not change.
- Every role holds `feedback:submit` and `search:query`, whatever you select.
- If you are not an owner, you can only add or remove permissions you hold
  yourself. You cannot edit, restore, or delete a role that holds permissions
  you do not have, and you cannot give anyone such a role, whether you invite
  them into it or add it on the **Team** page. The console shows
  **You do not hold this permission, so you cannot add it to or take it away
  from a role.** beside a permission you cannot change. A role you cannot edit
  opens read-only, with **This role holds permissions you do not hold
  yourself, so you cannot edit it. An owner can.** On the **Team** page, such
  a role is locked with **This role grants permissions you do not hold, so you
  cannot give or take it away.**, and the invite form leaves it out.
- Only an owner can give or take away the **Owner** role.

## Create or clone a role

1. Go to **Settings** > **Roles**.
2. Select **New role**. To start from an existing role instead, select
   **Clone** on its row.
3. In **Name**, enter the role's name. Optionally, enter a **Description**,
   which is shown wherever someone picks a role.
4. In **Start from**, choose the role whose permissions the new role copies,
   or **No permissions**. **Clone** fills this in for you.
5. Select **Create role**. The role opens so you can change its permissions.

## Change a role's permissions

1. Go to **Settings** > **Roles**, and select the role.
2. Under **Permissions**, open an area, or enter a name, code, or description
   in **Search permissions**. A search opens every area with a match.
3. Select or clear the permissions. The count shows how many the role holds.
4. Select **Review and save**. The console lists the permissions you are
   adding and removing, and how many people hold the role.
5. Select **Save permissions**, or **Keep editing** to go back.

To change the name or description, edit them under **Details** and select
**Save details**.

To narrow how technicians connect to endpoints, clear `remote:unattended`,
`remote:attended`, `remote:consent`, or `remote:escorted` from their role. See
[Permission for each mode](/remote-access/access-modes/#mode-permissions).

## Restore a built-in role's defaults

1. Open the built-in role from **Settings** > **Roles**.
2. Select **Restore defaults**, then **Restore defaults** again to confirm.

The role gets back the permissions it shipped with, and the changes made to it
are replaced.

## Delete a custom role

You can delete a custom role, including **Sales** and **Project manager**,
only when nobody holds it. Built-in roles cannot be deleted, and the console
does not offer **Delete** for them.

1. Take the role away from everyone who holds it. The role's page lists them
   under **People with this role**.
2. Go to **Settings** > **Roles**, and select **Delete** on the role's row.
3. Confirm.

## Change a person's roles

1. Go to **Settings** > **Team**.
2. On the person's row, select **Roles**.
3. Select the roles they should hold, and clear the ones they should not.
   Each change saves at once.

The change applies from the person's next request, and they receive an email
saying their account permissions were changed. Your organization always keeps
at least one active owner.

## Verify

- The role's page shows the permission count you expect, and **People with
  this role** lists the right people.
- Each change is recorded in the audit log, including the permissions added
  and removed. See [Audit logs](/depot/audit-log/).

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| A permission's checkbox is unavailable | You are not an owner and do not hold that permission. | Ask an owner to make the change. |
| **That role holds permissions you do not have. Ask an owner.**, followed by **Permissions involved:** and the permission codes | You are not an owner, and the role, or the role you are giving someone, holds the listed permissions, which you lack. | Ask an owner. |
| **You can only grant permissions you hold yourself.**, followed by **Permissions involved:** and the permission codes | You are not an owner, and you tried to add the listed permissions to a role without holding them. | Clear them, or ask an owner. |
| **Delete** is unavailable | People still hold the role. | Take the role away from them on the **Team** page first. |
| **Roles** is missing from **Settings** | You do not hold `role:manage`. | Ask an owner. |

## Related

- [Roles and permissions](/depot/roles-and-permissions/)
- [Permissions](/reference/permissions/)
- [Invite your team](/depot/invite-your-team/)