# Roles and what they can see

> The stock Unifuse roles (Admin, Advisor, Dean, Viewer, Student), what each one can do, and how permissions decide which screens appear.

Source: https://docs.unifuse.ai/getting-started/roles/

Everything you can see and do in Unifuse is decided by the permissions on your role. The
sidebar only shows the areas you can open, and the server enforces the same permissions on
every request, so hiding a screen is never the only protection.

## Stock roles

Every institution starts with these roles. Administrators can change their permissions
(except Admin) and create more. See [Roles](/administration/roles/).

| Role | Purpose | Typical use |
|---|---|---|
| **Admin** | Full access, including every Administration screen. Its permissions cannot be edited. | The institution's Unifuse owners. |
| **Advisor** | View and manage assigned students, read the knowledge base, run campaigns and surveys, work with agents, approve routine agent actions, send messages, export data and read conversation logs. Cannot manage the knowledge base, grant student access, see Advancement or use Administration. | Advising and student-success staff. |
| **Dean** | Read-only across all of the institution's students, not just a caseload, with exports. No edits and no sending. | Leadership who need the whole picture. |
| **Viewer** | Read-only across the hubs. No escalation, export, sending or unmasking of personal data. | Auditors, new starters. |
| **Student** | The default role for anyone who signs in without a mapped role. Sees nothing in the staff workspace. | A safe landing role until an administrator assigns a real one. |

## How screens are gated

Each screen needs one permission. Some examples:

- **Audit Logs** needs *view audit*, which only Admin holds by default.
- **Integrations** needs *manage connectors*.
- **Channels** needs *manage channels*.
- The **Administration** link appears if you hold any of *manage institution*, *manage SCIM*,
  *manage roles* or *manage users*, and each Administration tab is shown only to the
  permissions it needs.

Changes to a role's permissions take effect on the next request. Nobody has to sign out and
back in.

## Student scope

Advisors see the students assigned to them. Roles with *full student access* (Admin and Dean
by default) see every student at the institution.

## Related

- [Roles](/administration/roles/) for editing the permission matrix
- [Users](/administration/users/) for assigning roles