# Roles and permissions

A role is a named set of permissions. You build roles from 17 named permissions, grouped into movements, vaults and assets, viewing, and administration, and assign one role to each member of a workspace.

> Part of the SQRL documentation, section "SQRL Enterprise".
> Rendered page: https://docs.sqrl.tech/enterprise/users-roles-and-permissions/roles-and-permissions

See the [Permission reference](/appendices/permission-reference) for every permission and what it allows.

## Default roles

Every workspace starts with these roles. Apart from Owner, you can change their permissions or replace them.

* **Owner.** Every permission in the workspace.
* **Admin.** Every permission except Owner. Day-to-day workspace administration.
* **Initiator.** Initiate movement and View balances. Creates transfers for others to sign.
* **Minter.** Mint tokens and View balances. Issues new tokens within the supply cap and the vault's limit.
* **Burner.** Burn tokens and View balances. Destroys tokens on redemption and executes clawbacks a compliance officer requests.
* **Pauser.** Pause tokens and View balances. Halts and resumes an asset.
* **Compliance officer.** Manage compliance, View balances and View logs. Manages whitelists and the Address Book, screens, freezes and releases, and requests clawbacks. May not mint or burn.

## Maker-checker

Every asset action and movement is maker-checker. The operator who proposes an action cannot be one of the signers who approves it, so no single person can both propose and complete a mint, a burn, a freeze or a clawback.

## Creating a role

**Required permissions:** Manage permissions (`MANAGE_USER_PERMS`).

1. Open **Policies** and select the **Roles & Permissions** tab.
2. Select **Add role**.
3. Enter a name and a description.
4. Set the role's **Transaction limit (Tokens)** and its cycle. See [Vault policies](/enterprise/vaults/vault-policies).
5. Select the permissions to include.
6. Save the role.

The role is available in this workspace only.

## Changing a role's permissions

**Required permissions:** Manage policies (`MANAGE_ROLES`).

1. Open **Policies** › **Roles & Permissions**.
2. Select **Edit permissions** on the role.
3. Add or remove permissions and save.

  A permission change applies to everyone who holds the role, within two minutes. Review the impact before you save, especially for Approve movement, the mint and burn permissions, and Manage compliance.

  Build roles around duties, not people. Give minting, burning, pausing and compliance to different roles, and maker-checker makes sure no single operator can complete an action alone.