> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Roles


Enterprise Edition

**Role management** requires JumpServer Enterprise Edition. Enterprise Edition
lets you create system and organization roles and define their permissions.
Community Edition can only use the built-in roles. It cannot create roles or
modify the permissions granted by an existing role.

[Request 14-day free trial](https://www.jumpserver.com/free-trial)

Roles define what an administrator, auditor, or user is allowed to do. Since
v4.9, role management lives in **System Settings**. JumpServer uses two role
scopes: system roles, which apply across the whole deployment, and organization
roles, which apply only inside one organization.

| Capability              | Community Edition | Enterprise Edition |
| ----------------------- | ----------------- | ------------------ |
| Use built-in roles      | Yes               | Yes                |
| Create custom roles     | No                | Yes                |
| Modify role permissions | No                | Yes                |

## Overview

JumpServer ships with default roles that cover the common personas. Default
roles cannot be edited or deleted. In Enterprise Edition, to change what a
default role grants, duplicate it, adjust the copy, and assign the copy to users
instead. Community Edition cannot create or customize roles.

| Scope              | Default roles                                               |
| ------------------ | ----------------------------------------------------------- |
| System roles       | System admin, System auditor, User, System component        |
| Organization roles | Organization admin, Organization auditor, Organization user |

A role is more than a name. It carries a permission set, a list of assigned
users, and an activity record, so you can see who holds the role and what
changed over time.

## Create a role


Note

Creating roles is available in Enterprise Edition only. Community Edition uses
the built-in roles and cannot modify their permissions.


1

In the right area of the top navigation bar, click .

![image](/docs/images/docs/navs/nav-settings.png)

2

In the left menu, click **Roles**.

3

Click **Create** and choose whether the role is a system role or an
organization role.

4

Type a name and an optional description, then click **Submit**.

5

On the role detail page, select the permissions the role should grant in the
**Permissions** section.

6

Click **Update** to save the permission set.

![Figure 1: Create a role](/images/v5/jumpserver/v5_settings_roles_create_01.png)

## Assign users and review activity


1

In the right area of the top navigation bar, click .

![image](/docs/images/docs/navs/nav-settings.png)

2

In the left menu, click **Roles**, then click the role name.

3

Open the **Users** tab and add the users who should receive this role.

4

Open the **Activity** tab to review changes made to the role and its
assignments.

![Figure 2: Role detail page](/images/v5/jumpserver/v5_settings_roles_detail_01.png)

## Field reference

| Section     | Description                                                                                              |
| ----------- | -------------------------------------------------------------------------------------------------------- |
| Basic       | Role name, scope, built-in flag, creator, and description.                                               |
| Permissions | The functions the role can use. Permissions are grouped by module and can be checked or cleared in bulk. |
| Users       | Users bound to the role. Assigning a role grants its permissions to those users.                         |
| Activity    | Audit trail of role and assignment changes.                                                              |

## Manage existing roles

- **View**: built-in roles are read-only in every edition. Their permissions
  cannot be changed.
- **Edit**: in Enterprise Edition, edit the name or description of a custom
  role from the role list.
- **Duplicate**: in Enterprise Edition, use the more actions menu to create a
  copy, then adjust the copied permissions. Duplicating is the fastest way to
  build a role that is close to a default role.
- **Delete**: in Enterprise Edition, delete a non-built-in role. Deleting a
  role removes its permissions from every assigned user.
- **Community Edition**: only the built-in roles are available. Creating,
  editing, duplicating, and deleting roles are unavailable.


Note

Role changes take effect on the next authorization check. A user who is already
signed in is not forced out, but the menus and actions they can use are
re-evaluated from the new permission set.