> For the complete documentation index, see [llms.txt](https://docs.flopsar.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flopsar.com/7/administrator-guide/managing-roles.md).

# Managing Roles

Roles are managed in **Access Management → Roles**. Each user has exactly one role. A role is a set of permissions, an optional list of banned applications, and an optional LDAP group DN.

<figure><img src="https://1957839935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQzShZISPoFZ9zIHUdjNB%2Fuploads%2Fkx4ioQeRfRXMJ10OFdxi%2FScreenshot%202026-09-21%20at%2013-25-26%20.png?alt=media&amp;token=b65dbb2e-b11f-4892-ad2d-65fc6caa38dc" alt=""><figcaption></figcaption></figure>

Only an **Owner** can create a new role (**Add Role**). Viewing the page requires **View roles**. Editing users (assigning a role) is a separate permission on the Users page.

## Built-in roles

* **Owner** — all permissions. Cannot be modified or deleted.
* **Guest** — no permissions. Cannot be modified or deleted. LDAP users whose directory groups do not map to any role receive Guest for that session.

## Custom roles

Give the role a name, then enable the permissions the group of operators actually needs. Changes take effect the next time a session token is issued for an affected user (at most the 12-hour token lifetime).

Optionally set **banned applications** on the role so that even with **View data**, those applications are hidden. Individual users can have additional bans; both lists apply.

## LDAP group mapping

A custom role may have an **LDAP group DN**. On each LDAP login, Flopsar compares the user's group memberships (case-insensitive) to these mappings and assigns the matching role. If several groups match, the role with the most permissions wins; ties are broken by role id. If none match, the session uses **Guest**.

LDAP identities are **not** stored. Changing a mapping or a directory group takes effect at the user's next login. See [LDAP](/7/administrator-guide/ldap.md).

## Permission catalog

Titles match the Workstation checklist.

### Users and access

| Permission | Allows                                       |
| ---------- | -------------------------------------------- |
| View users | List local accounts                          |
| Edit users | Create, edit, lock, or delete local accounts |
| View roles | Open this page                               |
| View LDAP  | Read directory settings                      |
| Edit LDAP  | Change directory settings                    |

### Agents and data

| Permission              | Allows                                                                     |
| ----------------------- | -------------------------------------------------------------------------- |
| View agents             | See connected instances                                                    |
| Query agents            | Run live JVM queries (command line, thread dump, class bytes, and similar) |
| Switch agent's features | Enable heap dump / thread sampling on an instance                          |
| View live               | Open Live View                                                             |
| View data               | Open Analytics views (browser, analysis, correlation, key-value)           |
| View parameters         | See captured method arguments                                              |

### Profiles and configuration

| Permission          | Allows                                        |
| ------------------- | --------------------------------------------- |
| View profiles       | Open profiles                                 |
| Edit profiles       | Create, modify, or delete profiles            |
| Edit profiles state | Change draft / ready / active state           |
| Deploy profiles     | Deploy, redeploy, or undeploy                 |
| Assign applications | Bind applications to profiles                 |
| Edit filters        | Manage dashboards, charts, and matching rules |
| Edit data masking   | Manage masking patterns                       |
| Manage plugins      | Install or remove plugins                     |
| View plugins        | See installed plugins                         |
| View plugins source | Open plugin source in the Workstation         |

### License, server, archives, AI

| Permission            | Allows                                                                                              |
| --------------------- | --------------------------------------------------------------------------------------------------- |
| View license          | See license status and assignments                                                                  |
| Update license        | Replace the license file                                                                            |
| Edit license mappings | Change license-to-application assignments                                                           |
| View server info      | Server Details, Stats, and Database                                                                 |
| Query server          | Refresh server-side listings (for example archives)                                                 |
| Delete application    | Remove stored data for an application                                                               |
| View archives         | Open Database Archives                                                                              |
| Edit archives         | Delete archive files                                                                                |
| Edit agent tokens     | Create and delete PSKs                                                                              |
| View AI settings      | Open **Administration → AI Assistant** and read the configuration (secrets are never shown)         |
| Edit AI settings      | Change provider, keys, tool policy, proxy/TLS, and reset the token counter                          |
| Use AI assistant      | Open the analyst chat and AI Analysis; still requires the assistant to be enabled and **View data** |

The **Owner** role implicitly satisfies every check. Permissions are evaluated with OR logic: if a route accepts more than one permission, holding any of them is enough.