> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/concepts/intermediate-concepts/roles.md).

# Roles

Roles in Devolutions Server are permission sets assigned to users, groups, or application identities for workspaces, vaults, and PAM providers.

Roles are sets of permissions assigned to users, user groups, or application identities. They govern access to workspaces, vaults, and PAM providers, and are separate from inheritable permissions, which control what a specific user or user group can do in a given entry or folder within a vault.

There are many roles for different use cases, but all fall into three categories: ***Members***, ***Administrators***, and ***Owners***:

* ***Members*** have the fewest permissions. They can only view the content of specific vaults, and what they can do inside those vaults is controlled separately via [Permissions](/server/web-interface/user-group-based-security/permissions.md).
* ***Administrators*** can manage users, security settings, password policies, licenses, preferences, and similar settings. Since their rights are limited to management, they don't automatically get access to the content of the vaults or PAM providers they administer.
* ***Owners*** have full permissions within their assigned scope. For security reasons, it's strongly recommended to keep the number of owners to a minimum, for example one per vault.

To see which roles are assigned to you, head to Devolutions Server web interface, click on your avatar in the top right corner, and select [***My roles***](/server/web-interface/account-menu/my-roles.md).

## **Role assignments**

Assigning roles to users requires adding ***Role assignments***. These are accessible from several places, namely:

* The ***Role assignments*** section, under ***Administration*** – ***Configuration and security***, which lists every role assignment in the workspace and lets you add new ones.
* Directly where these roles apply:
  * ***Administration*** – ***Vaults*** – ***Edit*** – ***Role assignments***
  * ***Administration*** – ***Users*** – ***Edit*** – ***Role assignments***
  * ***Administration*** – ***User groups*** – ***Edit*** – ***Role assignments***
  * ***Administration*** – ***Application identities*** – ***Edit*** – ***Role assignments***

## Auditing role assignments

Every role assignment is logged, including an administrator granting themselves access to a vault. Head to ***Reports*** – ***Security***, then choose between the ***Vault role assignments***, ***Workspace role assignments***, and ***Redundant role assignments*** reports.

These reports show who holds which roles, how they got them, and what their scope is. The ***Redundant role assignments*** report additionally flags redundant assignments so they can be cleaned up.

## Built-in roles

Roles can be assigned at three scopes: ***Workspace***, ***Vault***, and ***PAM provider***.

<table data-search="false"><thead><tr><th>Role</th><th>Description</th></tr></thead><tbody><tr><td><strong>Workspace owne</strong>r</td><td>Grants unrestricted access to the whole workspace, including every vault and its content. Assigned automatically to users and groups flagged as workspace owners; it cannot be granted, edited or removed manually.</td></tr><tr><td><strong>Workspace administrator</strong></td><td>Administer every area of the workspace: users, roles, vaults, settings, licenses, logs and PAM. Does not grant access to the content of the vaults.</td></tr><tr><td><strong>Users and identities administrator</strong></td><td>Create, edit, delete, unlock and disconnect user accounts and application identities, manage their MFA and API keys, create and manage user groups and their members, and view user activity and license assignment reports.</td></tr><tr><td><strong>Vaults administrator</strong></td><td>Create, edit and delete vaults, manage their gateways and their user assignments. Does not grant access to the content of the vaults.</td></tr><tr><td><strong>PAM administrator</strong></td><td>Configure every PAM setting (policies, templates, OTP, propagation, risk), fully manage all privileged access providers including account discovery and discovery results, and view active privileged sessions.</td></tr><tr><td><strong>Gateway administrator</strong></td><td>Manage Devolutions Gateway instances, review who can use them and which permissions apply, and terminate active gateway sessions.</td></tr><tr><td><strong>Vault member</strong></td><td>Grants access to the content of the assigned vaults. Entry permissions defined in the vault still applies.</td></tr><tr><td><strong>Vault owner</strong></td><td>Manage every aspect of an assigned vault: its content, permissions, access requests, entry statuses, deleted entries, reports and session recordings, as well as the vault's own configuration, gateways and assignments.</td></tr><tr><td><strong>PAM provider owner</strong></td><td>Manage every aspect of an assigned privileged access provider, including its account discovery configuration, discovery results, group listing and assignments. Does not allow creating new providers.</td></tr><tr><td><strong>Licenses administrator</strong></td><td>Add, edit, delete and assign licenses, and view license usage and user license reports.</td></tr><tr><td><strong>Entry templates administrator</strong></td><td>Create, edit, delete and export entry templates, set the default template and review where each template is used.</td></tr><tr><td><strong>Password policies administrator</strong></td><td>Create, edit, delete and export password policies and passphrase dictionaries.</td></tr><tr><td><strong>System images administrator</strong></td><td>Create, edit, delete and clean up the system images available in the workspace.</td></tr><tr><td><strong>PAM account creator</strong></td><td>Create PAM accounts on an assigned privileged access provider. Does not grant any other permission on the provider.</td></tr><tr><td><strong>Workspace log viewer</strong></td><td>View the server and administration logs of the workspace, the login attempts and login history, the PAM logs, and the activity logs of every vault.</td></tr><tr><td><strong>Privileged sessions supervisor</strong></td><td>View active privileged sessions and terminate them.</td></tr><tr><td><strong>Auditor</strong></td><td>Read-only view of the whole administration section: users, groups, roles, vaults, settings, licenses, logs and reports. Does not grant access to the content of the vaults.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.devolutions.net/server/concepts/intermediate-concepts/roles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.