---
title: "Roles & Permissions"
slug: help-roles-permissions
section: In-App Help
status: stable
description: "In-app help · Understanding who can do what in Globus"
last-updated: 2026-10-07
---

# Roles & Permissions

In-app help · Understanding who can do what in Globus

## Understanding Roles

Every user in Globus holds one or more roles, and permissions come from roles: each role carries a fixed set of grants, and your effective access is the union of every role you hold, including roles you inherit through membership in a role group. A role group has no permissions of its own, but it attaches roles to its members, so group membership can grant access. When an admin creates your account they must pick your role explicitly — there is no default.

> **Architecture Reference**
>
> This page is a simplified guide for staff users. For the full technical RBAC model, see Roles & Governance .

## System Role Hierarchy

Roles sit on a seniority ladder that only limits who can assign which role: you can grant only roles strictly below your own tier (System Admins are unbounded). Permissions are not inherited between roles; each role carries its own fixed set of grants.

## Permission Modules

Permissions are organized into modules. Each module controls access to a specific area of the system.

## Assigning Roles to Users

Only users with the Users & Access permission can assign roles. The process:

## Checking Your Permissions

To see what you have access to, click the My access shield icon beside your name at the bottom of the sidebar (opens Settings, My access). This shows your system role, assigned role groups, effective permissions, and scope. If something is greyed out in the UI, you likely lack the required permission. Contact your Brand Admin or System Admin to request additional access.

## Common Questions