> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Manage Roles

> Create, edit, and delete custom roles to control what users can do in Edge Infrastructure Services.

Role-based access control (RBAC) in Edge Infrastructure Services governs what each user can do and which resources they can access. A role is a named set of permissions that specifies which operations a user might perform across resource types such as nodes, edge applications, and enterprise settings.

## Introduction

This procedure covers how to create, edit, and delete custom roles. Roles are assigned to users individually. A user can hold one role at a time within an enterprise.

Roles are accessed from the **Users and roles** icon in the console header.

## Prerequisites

* You have the SysAdmin role in your enterprise.

## Role Types

The platform provides the following role types:

| Type | Description | Editable | Deletable |
| - | - | - | - |
| System | Built-in roles provided by ZEDEDA. Apply to all projects. | No | No |
| Custom | Roles you create for your enterprise. | Yes | Yes |
| Cluster | Automatically created when ZEDEDA Edge Kubernetes Service clusters are deployed. Read-only and managed by cluster administrators. | No | No |

System roles are read-only. You cannot modify or delete them. The four built-in System roles are:

Roles use four permission operations:

* **C** = Create (add new resources).
* **R** = Read (view resources without making changes).
* **U** = Update (modify existing resources).
* **D** = Delete (permanently remove resources).
* Enterprise settings are limited to Read and Update. Create and Delete are not available for that resource type.

| Role | Users | Edge Nodes | Edge Apps | Edge App Instances | Enterprise | Third Party Integrations |
| - | - | - | - | - | - | - |
| SysAdmin | CRUD | CRUD | CRUD | CRUD | RU | CRUD |
| SysManager | R | CRUD | CRUD | CRUD | — | CRUD |
| SysOperator | R | RU | RU | RU | — | RU |
| SysMonitor | R | R | R | R | — | R |

## Create a Role

1. Select the **Users and roles** icon in the header, then select **Roles**.

2. Click the **+** button in the bottom-right corner.

3. On the Create New Role screen, select one of the following:
   * **Add role** to create a role from scratch.
   * **Clone role from existing** to start from an existing role's permissions. Search for and select the source role. The new role pre-fills with the source role's title, description, and permissions.

4. In the **Identity** section, complete the following fields:

   | Field | Required | Notes |
   | - | - | - |
   | Name | Yes | Letters, numbers, hyphens, and underscores only. Spaces are converted to hyphens. Cannot be changed after creation. |
   | Description | No | Brief explanation of the role's purpose. Maximum 256 characters. |

   The role's display title is derived from **Name** as you type and is shown on the **Display title:** line below the field. To set a different title, click the pencil icon next to that line. The **Title** field then appears, pre-filled with the current value. After you edit the title, it no longer follows changes to **Name**.

5. In the **Scope** section, define which projects this role applies to. By default, a role applies to all projects. To restrict the role to specific projects, click **Add tag**, then enter a **Key** and an optional **Value** for the project tag. Add additional tags as needed. Tag keys must be unique within the scope.

6. In the **Permissions** section, assign operations for each resource type. The resource types are: Users, Edge Nodes, Edge Apps, Edge App Instances, Enterprise, and Third Party Integrations. The available operations are: Create, Read, Update, and Delete. To apply a permission preset to all resource types at once, click **Administrator**, **Editor**, **Viewer**, or **No access**. To configure permissions per resource type individually, use the permission matrix. Click **Add Scope** to add a separate permission scope for a different project tag set.

7. Click **Create role**.

## Clone a Role

Cloning creates a new Custom role that starts with the name, title, description, and permissions of an existing role. You can clone any role type, including System roles.

1. Select the **Users and roles** icon in the header, then select **Roles**.
2. Click the **+** button in the bottom-right corner.
3. On the Create New Role screen, select **Clone role from existing**.
4. Search for and select the source role. The form pre-fills with the source role's title, description, and permissions.
5. Enter a unique **Name** for the new role. The name cannot match any existing role and cannot be changed after creation.
6. Update the **Description**, **Scope**, and **Permissions** as needed. The source role's title carries over and is not overwritten when you type the new name. To change it, click the pencil icon next to the **Display title:** line.
7. Click **Create role**.

## Edit a Role

Only Custom roles can be edited. System and Cluster roles are read-only.

1. Select the **Users and roles** icon in the header, then select **Roles**.
2. Click the role name to open its detail page, or click the row action menu and select **Edit**.
3. Update the **Title**, **Description**, or **Permissions** as needed. The **Name** field is permanent and cannot be changed.
4. Click **Save**.

## Delete a Role

Only Custom roles can be deleted. A role that is currently assigned to one or more users cannot be deleted. Unassign the role from all users before proceeding.

**To delete a single role:**

1. Select the **Users and roles** icon in the header, then select **Roles**.
2. Click the role name to open its detail page.
3. Click the **Delete role** button (trash icon) in the page header.
4. Review the confirmation message, then click **Delete**.

**To delete multiple roles at once:**

1. In the Roles list, select the checkboxes for the Custom roles you want to delete. System and Cluster roles cannot be selected for bulk deletion.
2. From the **Bulk Actions** menu, select **Delete**.
3. Review the count in the confirmation dialog, then click **Confirm**.

## Next Steps

> [card] [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md)
>
> Assign roles to users.

> [card] [Configure Two-Factor Authentication](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/configure-2fa.md)
>
> Enforce 2FA across your enterprise.

> [card] [Enable Single Sign-On](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enable-sso.md)
>
> Connect an external identity provider.

> [card] [Tagging](https://zededa.mintlify.site/new-ui/start/tagging.md)
>
> Understand how project tags are used to scope a role to a subset of the fleet.