# Roles

> Edit the permission matrix for your institution's Unifuse roles, create roles from scratch or by copying, and understand the rules that protect you from locking yourself out.

Source: https://docs.unifuse.ai/administration/roles/

The **Roles** tab is a matrix of permissions against roles. It is where you decide what each
kind of user at your institution can see and do.

## Before you start

- You need the *manage roles* permission.
- Open **Administration → Roles**.
- Read [Roles and what they can see](/getting-started/roles/) for the stock roles.

## Read the matrix

Rows are permissions, grouped by product area, each with a short description. Columns are
roles; each header shows how many permissions and how many users the role has, and marks the
institution's default role.

## Grant or remove a permission

Select a cell to grant the permission to that role, or select it again to remove it. The
change applies on the next request for everyone with the role; nobody needs to sign in
again.

## Create a role

1. Select **Create role** and enter a **Role name**. Names must be unique.
2. Choose **Start empty** or **Copy from** an existing role.
3. Grant permissions in the matrix.

## Delete a role

**Delete** is offered only on a role that is not the default role, is not the Admin role, and
has no users. Move users to another role first.

## Rules

- The Admin role holds every permission and cannot be edited.
- You cannot edit the permissions of the role you hold yourself.
- You cannot grant a permission that you do not hold.
- Changing which role is the default for new users is not available on this screen. Ask
  Unifuse support.

## Related

- [Users](/administration/users/)