---
title: "Role Groups"
slug: help-role-groups
section: In-App Help
status: stable
description: "In-app help · Admin > Access Control > Role Groups"
last-updated: 2026-10-07
---

# Role Groups

In-app help · Admin > Access Control > Role Groups

## What Are Role Groups?

A Role Group is an organizational container — it groups related roles (e.g., "Compliance", "Program Management") so the admin screens stay readable as the role list grows. A Role Group carries no permissions of its own, but membership is consulted when permissions are resolved: a member inherits every role attached to the group, so attaching roles or adding members is an access-granting change.

> **Role Groups vs Roles (QA 2026-07)**
>
> Roles grant permissions; groups organize roles. The earlier model where a Role Group carried its own permission bundle was removed in the QA 2026-07 RBAC overhaul — if you are looking for where access is granted, it is always the role. A user's group membership is kept in sync automatically from the roles assigned in User Management. See the Roles & Governance page for the full RBAC architecture.

## Default Role Groups

Globus ships with pre-configured role groups that sort the built-in roles into teams. These cannot be deleted but can be cloned or customised. The "Roles Organized Here" column is descriptive — the permissions themselves live on the roles.

| Role Group | Roles Organized Here | What the Team Does |
| --- | --- | --- |
| Admin | System Administrator | System administration: integrations, automations, settings, feature flags |
| Compliance | Compliance Admin, Compliance Officer | Compliance rule authoring, review queue, SEVIS oversight |
| Program Management | Program Admin, Program Manager, Host Manager, Applicant Manager, Support Manager | Program-scoped roles: program management, delegation within a program, and day-to-day applicant and host journey operations |
| Executive | Readonly | View-only access for executives and auditors |
| Brand Management | Brand Admin, Brand Manager | Brand-level administration and oversight |
| External | Partner and host portal roles | External portal users (access managed via the portals, not here) |
| Hub | Hub Support, Hub Admin | Brand/program-scoped Hub operational staff |
| Legal | Legal | Brand legal-policy management (disclaimer, privacy policy) |

## Creating a Role Group

Navigate to Admin > Access Control > Role Groups > Create. A group is a name, a description, and a display order — it carries no permissions. Attach roles to it to organize them; users appear in the group automatically when they hold one of its roles.

> **Groups never widen access**
>
> Groups carry no permissions of their own, but members inherit every role attached to the group, so attaching a role to a group or adding a member can grant access and is checked against the delegation ceiling. Role assignment (and its delegation ceiling) is where access control happens — see Roles & Permissions.

## Editing & Deactivating

Changes to a Role Group take effect immediately, but they only affect how roles are displayed and organized — never what any member can do. Deactivating a group soft-disables the container; members keep their roles and all of their access.

## Scoping to Brands & Programs

Access scope is configured per user in the Configure Access Scope dialog (brand, program, and season), not on the group. A group can be used to organize a brand's or program's team, but the data boundary always comes from each member's own scope grants.

## Common Questions