# Roles and permissions

> See which pages every role can open, which pages need an extra permission, and what each role can access

---

Site [llms.txt](/llms.txt)

---

Every user has one of four roles: **Admin**, **Operations**, **Practitioner**, or **Stakeholder**. Roles are assigned when a user is invited and can be changed later from [User Management](/docs/cbp/navigating-the-platform/settings/user-management/). For a description of what each role means, see [Manage roles](/docs/cbp/getting-started/manage-organizations-users-roles/roles/).

Most pages in the platform are open to any authenticated member of your organization, regardless of role. A smaller set of administrative pages require a specific permission level on top of your role.

## Pages open to every role

These pages have no permission requirement. Any authenticated member of your organization can access them; whether they actually appear in your sidebar still depends on which features are enabled for your organization.

- Dashboard
- Cost Explorer
- Budgets (the reporting view; see below for the settings page that manages budget targets)
- AI Spend
- Resource Inventory
- Tag Analysis
- Commitments
- Recommendations
- Security
- Kubernetes Report
- Saved Reports and Summary Report

## Pages that require a specific permission

These pages check for a permission level in addition to a valid login. Today, **Admin** is the only role with any organization-level permission, so it's the only role that can reach the Settings pages below; **Operations** has a separate permission that opens Connections, and **Anomalies** has its own permission that both Practitioner and Stakeholder hold.

| Page | Permission required | Roles with access today |
| --- | --- | --- |
| Connections | Cloud Provider Management: Viewer or Owner | Admin, Operations |
| Anomalies | Cost Reports: Viewer or Owner | Admin, Practitioner (Owner), Stakeholder (Viewer) |
| User Management | Organization: Viewer or Owner | Admin |
| Organizations | Organization: Viewer or Owner | Admin |
| Billing Rulesets | Organization: Viewer or Owner | Admin |
| Custom Metrics | Organization: Viewer or Owner | Admin |
| Cost Allocation | Organization: Viewer or Owner | Admin |
| Virtual Tags | Organization: Viewer or Owner | Admin |
| Budgets (Settings) | Organization: Viewer or Owner | Admin |
| API Keys | Organization: Owner only | Admin |

## Roles at a glance

| Role | Additional access |
| --- | --- |
| Admin | Every page, including all Settings pages and API Keys. |
| Operations | Connections. No access to Settings pages or Anomalies. |
| Practitioner | Anomalies (full access). No access to Connections or other Settings pages. |
| Stakeholder | Anomalies (view-only). No access to Connections or other Settings pages. |