# Roles, permissions, and access

> Overview of OneFuse global and workspace roles and the permissions granted to each

---

Site [llms.txt](/llms.txt)

---

To access OneFuse features, users need to be added to the system with the appropriate roles and granted access to a [Workspace](/docs/onefuse/concepts/workspace/). Feature availability is based on the access role assigned to a user.

OneFuse roles are grouped into two categories: **Global** role and **Workspace** roles.

## Summary

The following table shows the features available for each role.

<div class="alert alert-info" role="alert">


**Super Admin** is a Global role. **Admin**, **Member**, **Viewer**, and **Executor** are Workspace roles.
</div>


| Feature | Super Admin | Admin | Member | Viewer | Executor |
| --- | :---: | :---: | :---: | :---: | :---: |
| License OneFuse: add and remove OneFuse license key | ✓ | | | | |
| Manage local users: create, edit and delete users | ✓ | | | | |
| Access the default Workspace | | ✓ | ✓ | ✓ | ✓ |
| Manage Workspace users: add and remove users from the Workspace | | ✓ | | | |
| Execute Workspace Policies | | ✓ | ✓ | | ✓ |
| Create, edit, and delete Workspace items | | ✓ | ✓ | | |
| Read/view Workspace items | | ✓ | ✓ | ✓ | ✓ |
| Read/view Workspace jobs | | ✓ | ✓ | ✓ | ✓ |

## Global role

Grant the **Super Admin** role to a user to manage system-level configurations.

<div class="alert alert-info" role="alert">


The **Super Admin** role does **not** grant Workspace Admin rights (with the exception of the `admin` account). As a best practice, limit the number of Super Admins when adding new users.
</div>


To get started as a Super Admin, see [Super Admin UI](/docs/onefuse/getting-started/roles-and-permissions/super-admin-tasks/).

## Workspace roles

Grant one of the following Workspace roles to a user to grant access to the features they need within a given Workspace.

- **Admin**: Provides full administrative and API access in the Workspace. Refer to [Workspace admin tasks](/docs/onefuse/getting-started/roles-and-permissions/workspace-admin-tasks/).
- **Member**: Provides full API access in the Workspace.
- **Viewer**: Provides read-only API access in the Workspace.
- **Executor**: Provides the ability to execute Workspace Policies and read/view items and jobs.

---

Section pages:

- [Super admin tasks](/docs/onefuse/getting-started/roles-and-permissions/super-admin-tasks/): Manage local users, reset passwords, and grant CMP access as a Super Admin
- [User tasks](/docs/onefuse/getting-started/roles-and-permissions/user-tasks/): Update your profile settings and change your password
- [Workspace admin tasks](/docs/onefuse/getting-started/roles-and-permissions/workspace-admin-tasks/): Manage workspace users as a Workspace Admin