Roles and permissions
Decide which parts of the admin area each of your staff can reach.
Every user holds one role, and a role holds a set of permissions. A permission decides which pages open and which actions work.
Go to Admin > Management > Roles & Permissions. You need View Roles to open it, and Manage Roles to change anything.
The role list
The page shows a card for each role. A card holds:
- The role name and the slug.
- A System badge and a padlock icon on a system role.
- The description.
- The number of users with the role.
- The priority number.
- The rate limit multiplier, for example "2x rate".
- The number of granted permissions.
Use the Search roles... box to filter by name or description.
System roles
A fresh install has three system roles:
| Role | Slug | Description |
|---|---|---|
| Administrator | admin | Full access to everything. |
| Moderator | moderator | Limited administrative access. |
| User | user | Standard user access. This role is the default for a new account. |
You cannot delete a system role. You cannot rename one, and you cannot change its priority. You can still change its permissions.
The Administrator role is special. The panel grants it every permission at each start-up. No other role can out-rank it.
Priority
Priority is a number from 1 to 1000. A lower number means more privilege. The Administrator role is 1. The default for a new role is 100.
Priority sets the boundaries of your own admin work:
- You cannot create, edit, or delete a role at or above your own priority.
- You cannot edit a user whose role is at or above your own.
- When you assign a role, the dropdown shows only the roles at or below your own.
Rate limit multiplier
The rate limit multiplier scales the API rate limit for every user with the role. The range is 0.1 to 100. The default is 1.0. An admin role usually uses about 10.
A value of 2.0 doubles the permitted request rate. A value of 0.5 halves it.
Creating a role
WARNING
Grant only the permissions that the role needs. A permission such as Delete Servers lets every user with the role delete servers.
- Navigate to Admin > Management > Roles & Permissions and click Create Role.
- Enter the Role Name. The minimum is 2 characters.
- Enter a Description. This field is optional.
- Set the Priority.
- Set the Rate Limit Multiplier.
- Open each permission category and tick the permissions to grant. Click a category header to select or clear the whole category. Select all and Clear all work on the whole list.
- Click Create Role.
To make a role with full admin access, click Select all.
Your license caps the number of roles. Over that cap, the panel refuses to create the role.
Editing and deleting a role
Click the pencil icon on a card to edit the role. Click the bin icon to delete it. The bin icon does not appear on a system role.
The panel refuses to delete a role that still has users. Move those users to another role first.
Permission reference
The panel groups permissions by category. Each entry shows a display name and a short description. This table lists the permissions that gate the admin pages.
Management
| Permission | Grants |
|---|---|
| View Users | The Users page, the Active Sessions page, and the Resellers page. |
| Create Users | Creation of an account. |
| Update Users | Edits to an account, account locks, session revocation, and reseller changes. |
| Delete Users | Deletion of an account. |
| View Servers | The admin server list. |
| Create Servers | Creation of a server. |
| Update Servers | Edits to a server. |
| Delete Servers | Deletion of a server. |
| Server Power Control | Start, stop, and restart of a server. |
| Suspend Servers | Suspension of a server. |
Infrastructure
| Permission | Grants |
|---|---|
| View Nodes and Create / Update / Delete Nodes | The Nodes page and node changes. |
| View Allocations and Manage Allocations | The Network page and allocation changes. |
| View Database Hosts and Manage Database Hosts | The Databases page and host changes. |
| View Orchestrators and Manage Orchestrators | The orchestrator pages. |
| View Kubernetes and Manage Kubernetes | The Kubernetes page and cluster changes. |
| View Pods and Manage Pods | Pod listings, and pod deletion or restart. |
| View Maintenance and Schedule Maintenance | Maintenance windows. |
Configuration
| Permission | Grants |
|---|---|
| View Nests and Manage Nests | The Nests page and nest changes. |
| View Eggs and Manage Eggs | The Eggs page, plus egg import and export. |
| View Templates and Manage Templates | Server templates. |
Settings
| Permission | Grants |
|---|---|
| View Settings | The General settings page and the read-only settings pages. |
| Update Settings | Changes to panel settings, and the Advanced page and Customer Intake page. |
| Manage Email | The Mail settings. |
| View Security and Manage Security | The Security settings page, and account unlocks. |
| View OAuth and Manage OAuth | The OAuth / SSO settings. |
| View Roles and Manage Roles | This page and role changes. |
| View API Keys and Manage API Keys | The API Keys page and key changes. |
| View Audit Logs | The Activity Log page. |
| Manage Webhooks | The Webhooks page. |
| View System Info | The Dashboard and the Statistics page. |
| Manage System | Cache clearing and the System Updates page. |
| Manage Cloudflare | The Cloudflare integration and its DNS records. |
Appearance
| Permission | Grants |
|---|---|
| View Appearance | The Branding, Themes, and Fonts pages. |
| Manage Appearance | Changes to those pages, and asset uploads. |
| View Announcements and Manage Announcements | The Announcements page and announcement changes. |
Billing
| Permission | Grants |
|---|---|
| View Billing | The Billing section. |
| Manage Products | Products and prices. |
| Manage Orders | Orders. |
| Manage Invoices | Invoices. |
| Manage Coupons | Coupons. |
| Manage Gateways | Payment gateways. |
| Manage Credits | User credit balances. |
CRM
| Permission | Grants |
|---|---|
| View CRM | The CRM dashboard, customers, analytics, and renewals. |
| Manage CRM | Leads, tags, and customer records. |
Support
| Permission | Grants |
|---|---|
| View Tickets | The admin ticket list. |
| Reply to Tickets | Replies to a ticket. |
| Manage Tickets | Assignment, status changes, and ticket closure. |
| Internal Notes | Staff notes on a ticket. |
| Delete Tickets | Permanent deletion of a ticket. |
| Manage Ticket Categories | Ticket categories. |
Notifications
| Permission | Grants |
|---|---|
| Manage Notifications | The admin Notifications page and broadcasts. |
TIP
The permission list comes from the panel database. It can hold older duplicate entries with the same display name, for example a second View Roles. Grant the entry in the category that matches the page that you want to open.
Assigning a role
WARNING
Read the permissions of a role before you assign it. A role with admin permissions gives the user immediate access to the admin area.
- Navigate to Admin > Management > Users and open the account.
- In the Access card, choose the new Role.
- Click Save Changes.
The change takes effect at once. You can also set the role when you create the account.
The Roles page has no control to assign users. It shows the member count only.
Default role for new registrations
A new account from panel registration or from SSO receives the User role. That role has no admin access.
Next steps
- User Management - create and manage accounts.
- API Keys - keys for integrations.
- Active Sessions - end a signed-in session.