# Roles and permissions

> The four roles in Octiga, what each one can do, and how staff get access.

Each signed-in user has one of four roles. The role sets what they can do in Octiga and which tenants they can reach, and staff get it through the groups they belong to.

## The four roles

Octiga has four roles, ordered from most to least access. There are no custom roles and no per-user permission grants. Each role can do everything the roles below it can, so where these docs name the role an action needs, any higher role can do it too.

- **Admin** — full access to every tenant and every setting, including White labelling and Subscription.
- **L2 Support** — the same access as Admin across every tenant, except White labelling and Subscription, which stay Admin-only.
- **L1 Read/Write** — full access to day-to-day tenant work (baselines, remediation, mail flow, users) on assigned tenants only, plus read access to those tenants' events and alerts. Dismissing an alert and creating an event rule both need L2 Support. Read-only on MSP-level schemes. No access to Access controls, PSA integrations, Alert recipients or Report schedules.
- **L1 Read** — the same reach as L1 Read/Write, read-only everywhere.

> **Note:** Octiga's interface has previously described L2 Support as having no settings access. In practice, L2 Support has the same access as Admin everywhere except White labelling and Subscription.

## Capability matrix

| Capability              | Admin | L2 Support | L1 Read/Write | L1 Read   |
| ----------------------- | ----- | ---------- | ------------- | --------- |
| View tenants            | ✓     | ✓          | ✓             | ✓         |
| Manage tenant baselines | ✓     | ✓          | ✓             | read only |
| Run remediation         | ✓     | ✓          | ✓             | read only |
| Edit schemes            | ✓     | ✓          | read only     | read only |
| Dismiss alerts          | ✓     | ✓          | read only     | read only |
| Create event rules      | ✓     | ✓          | read only     | read only |
| Manage access groups    | ✓     | ✓          | —             | —         |
| Configure integrations  | ✓     | ✓          | —             | —         |
| Manage alert recipients | ✓     | ✓          | —             | —         |
| Manage report schedules | ✓     | ✓          | —             | —         |
| White labelling         | ✓     | —          | —             | —         |
| Subscription            | ✓     | —          | —             | —         |

A dash means the capability is left out of that role's navigation, not disabled.

## Tenant reach

Admin and L2 Support see every tenant the MSP has connected. L1 Read/Write and L1 Read see only the tenants assigned to their groups. This is enforced on the server, so an L1 user's tenant list and alert list hold only their own tenants, rather than every tenant with the rest hidden.

## How access is granted

Access comes from groups, not from a setting on an individual user. Each group has one role and a set of tenants, and staff are added to groups. A user in several groups takes the highest role among them, and their tenant reach comes from the groups that carry that role. The default Admins group is locked: its name and role are fixed, it can't be deleted, and only its membership can be edited.

[Access controls](https://docs.octiga.io/administration/access-controls/) covers creating a group, adding staff to it and changing its tenants.

## Hidden, not disabled

What a role can't reach is left out of the sidebar and the Settings menu rather than shown greyed out. If you can't see a section, your role doesn't include it, and there's nothing to unlock from inside the interface.

> **Note:** The two L1 roles see the same navigation. They differ in write access to tenant-level work, not in what the sidebar shows.

## Vocabulary

**Role** — One of four fixed levels (Admin, L2 Support, L1 Read/Write, L1 Read) that sets what a signed-in user can do. There are no custom roles.

**Group** — A collection of staff, given one role and a set of tenants. Access always comes from group membership.

**Tenant reach** — Which tenants a signed-in user can see and act on. Admin and L2 Support reach every tenant; L1 roles reach only the tenants assigned to their groups.