> For the complete documentation index, see [llms.txt](https://docs.request.biz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.request.biz/administrator-guide/security/roles.md).
# Roles
The **Roles** section gives the ability to create new roles, configure them and assign them to users. It consists of two sections; the left-hand side shows the **Roles** view while the right-hand side shows various tab pages to configure the role selected in the view on the left-hand side.
The *Administrator* role is a standard role in the space.vars.PRODUCT\_NAME system and is always shown. Permissions, options, and templates of the Administrator role cannot be modified. You can however, assign members to this role. By default this role is automatically linked to the admin user.
Roles with **Is default** checked are assigned automatically for newly registered users, also via Active Directory.
## Edit Role
There are five tabs available to configure a role: Permissions, Options, Templates, Members, and External Groups (as defined in your Active Directory system).
### **Permissions**
The **Permissions** tab provides the ability to set permissions for the available resource types. Currently the following resource types are supported:
* Requests
* Tasks
The toolbar at the top has an **Open** command, allowing to change permissions for a specific resource type:
### **Options**
The **Options** tab provides the ability to set specific options for a role. At the moment of writing, there is only one option available, named **Co-administrator**. It allows a non-admin user to access the space.vars.ADMIN\_FRONTEND\_NAME.
### **Templates**
The **Templates** tab provides the ability to select which templates a role has access to:
Using the **Manage Templates** button in the toolbar allows granting or revoking access to templates for a specific role:
The shown dialog shows two lists:
1. Available templates - these are templates that are not assigned to the role yet,
2. Selected templates - these are templates that have been assigned to the role.
You can move templates between both lists and then press the **Save** button when done.
### **Members**
The **Members** tab allows adding and/or removing users to/from the selected role:
Clicking the **Manage Members** button in the toolbar opens the following dialog:
This dialog works the same as the **Manage Templates** dialog described above.
### **External Groups (Optional)**
This tab is optional and depends on the **User Role Management** setting in the [External Authentication](/administrator-guide/security/settings.md#external-authentication) group of the [**Security > Settings**](/administrator-guide/security/settings.md) section. When this setting is set to the value `Automatically synchronize ... groups with roles on user login` the **External Groups** tab will become available:
This tab allows mapping groups defined in your Active Directory system (i.e. [Entra Microsoft ID](/administrator-guide/security/settings/microsoft-entra-id-meid.md) or [Active Directory Federation Services](/administrator-guide/security/settings/active-directory-federation-services-adfs.md)) to space.vars.PRODUCT\_NAME roles.
#### Adding Groups
The **Add Groups** command allows defining a new group or select an already existing group. To define a new group, the name of the group needs to be typed in the **Group Name** field and pressing the Enter key.
An existing group can be selected by using the drop-down functionality of the editor. Once all of the required groups are identified, pressing the **Save** button will add them to the list of external groups that will now be recognized by space.vars.PRODUCT\_NAME.
#### Removing Groups
To remove a group-role mapping, select a group and use the **Remove** command. When the group is only used in this mapping (not in any other), the group will be deleted entirely and cannot be used for other mappings anymore. When the group is used in other mappings as well, it will only be removed for this group-role mapping. The group is still usable for other (new) mappings:
