> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.prividium.com/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

Roles are the basis of **role-based access control (RBAC)** in Prividium™: a role is a named set of permissions that
determines what contracts and functions a user can call through the **Prividium™ RPC**. Administrators create and
manage roles in the **Admin Dashboard**.

### 1. Open the Roles page

1. Go to the **Admin Dashboard** at `http://localhost:3000`.
2. Select **Roles** from the sidebar.
3. You will see a list of existing roles and the number of users assigned to each.

### 2. Create a new role

1. Click **Add Role**.
2. Enter a **Role Name** (e.g., `Trader`, `Auditor`).
   * The name is required and must be at most 25 characters.
3. **System permissions** (optional):
   * **Full Sequencer RPC Access**: Bypasses all permission checks and allows unrestricted RPC access. Required for
     contract deployment.
   * **Full Read Access**: Grants access to read all chain data (blocks, transactions, logs).
   * **Admin Read Access**: Grants read-only access to the admin panel. Users can view configuration but cannot create,
     update, or delete resources.
   * See [System Permissions](/configuring/users/system-permissions) for detailed information.
4. Click **Create**.

The new role appears in the list and is available for assignment to users.

### 3. Edit or delete a role

* **To rename or update a role:**

  1. Select the role from the list.
  2. Modify the name or system permissions.
  3. Click **Save**.

  Renaming is safe: a role keeps its identity when renamed, so every user assignment and contract permission that
  references it stays intact. A role name only needs to be unique within its own scope — the zone and each organization
  each have their own namespace, so two organizations can both have a role called `Trader`.

* **To delete a role:**
  1. Click the **Delete** icon next to the role name.
  2. Confirm the deletion.

> Note: A role cannot be deleted if it is still assigned to active users. Reassign or remove those users first.

### 4. Assign roles to users

1. Go to **Users** in the sidebar.
2. Select the user you want to update.
3. Under **Roles**, select one or more roles from the list.
4. Click **Save**.

Each user can hold multiple roles. A user’s effective permissions are the combination of all permissions granted to
their assigned roles.

Roles can also be set as **organization default roles**. When a user is created within an organization (e.g., by an M2M
application), they are automatically assigned the organization’s default roles. See
[Organizations](/configuring/chain/organizations)
for details.

### 5. Common role examples

| Role         | Purpose                | Typical Permissions                                       |
| ------------ | ---------------------- | --------------------------------------------------------- |
| **Admin**    | Full system management | Manage users, roles, permissions, and disclosure settings |
| **Trader**   | Executes transactions  | Write access to token contracts, trading functions        |
| **Auditor**  | Read-only observer     | View contract data and public disclosures                 |
| **Operator** | System maintainer      | Read/write access to operational contracts only           |

> You can customize role names and scopes to fit your organization’s structure.

### 6. Best practices

* Keep **Admin** roles limited to a small, trusted group.
* Use descriptive names that match your organization’s workflow.
* Avoid overlapping permissions across unrelated roles to maintain clarity.
* Review roles periodically as your deployment evolves.

***