> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thena.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Role-based access control (RBAC)

> Understanding user roles, permissions, and access control in the Thena platform

Role-based access control (RBAC) is a foundational security model in the Thena platform that ensures users have appropriate access based on their responsibilities and organizational hierarchy. This system protects sensitive operations while enabling efficient collaboration.

<Note>The Thena platform implements a progressive access model with five distinct user roles, each designed for specific use cases and access requirements</Note>

## User roles and permissions

The Thena platform provides five user roles, each with specific access levels and capabilities. Use the tabs below to explore each role in detail:

<Tabs>
  <Tab title="Org admin">
    <div style={{ marginBottom: '20px' }}>
      <strong>Organization administrators</strong> have comprehensive access to manage their organization's resources, settings, and members. This is the highest level of access within an organization.
    </div>

    <AccordionGroup>
      <Accordion title="Team management" icon="users-gear">
        * Create and delete teams
        * Add and remove team members
        * Update team configurations
        * Manage routing rules
        * Configure team settings
        * Set up team hierarchies
      </Accordion>

      <Accordion title="System configuration" icon="settings">
        * Manage ticket priorities, statuses, and types
        * Configure custom fields and objects
        * Set up tags and categories
        * Manage forms and templates
        * Configure organization settings
        * Control workflow automation
      </Accordion>

      <Accordion title="User management" icon="user-plus">
        * Send organization invitations
        * Manage user access and permissions
        * Configure notification channels
        * Oversee bulk operations
        * Control user role assignments
        * Manage user onboarding/offboarding
      </Accordion>

      <Accordion title="Billing and subscriptions" icon="credit-card">
        * View subscription details
        * Create and manage subscriptions
        * Access billing portal
        * Monitor usage and costs
        * Manage payment methods
        * Control subscription features
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Org user">
    <div style={{ marginBottom: '20px' }}>
      <strong>Organization users</strong> have full access to operational features within their organization for daily work. This is the standard role for most team members.
    </div>

    <AccordionGroup>
      <Accordion title="Ticket management" icon="ticket">
        * View, create, and update tickets
        * Add comments and reactions
        * Escalate and assign tickets
        * Create sub-tickets and link related tickets
        * Archive/unarchive tickets
        * Log time and view time logs
        * Use ticket templates and automation
      </Accordion>

      <Accordion title="Account management" icon="building">
        * View and create accounts
        * Update account information
        * Manage customer contacts
        * Add account notes and tasks
        * Track account activities
        * Manage account relationships
        * Access account history and insights
      </Accordion>

      <Accordion title="Personal settings" icon="user-gear">
        * Update personal profile and settings
        * Configure business hours and availability
        * Manage skills and integrations
        * Set notification preferences
        * Configure view preferences
        * Customize dashboard and workspace
      </Accordion>

      <Accordion title="Team collaboration" icon="users">
        * View team information and members
        * Access team configurations
        * View routing rules
        * Participate in communications
        * Use search and view features
        * Collaborate on shared resources
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Lite user">
    <div style={{ marginBottom: '20px' }}>
      <strong>Lite users</strong> have limited access focused on essential ticket management and viewing capabilities. This role is ideal for users who need basic access without full operational permissions.
    </div>

    <AccordionGroup>
      <Accordion title="Basic ticket access" icon="eye">
        * View assigned tickets
        * View ticket history
        * Access basic ticket information
        * Receive ticket notifications
      </Accordion>

      <Accordion title="Limited account access" icon="building-user">
        * View account information (read-only)
        * View account activities (read-only)
        * See account relationships
        * Access contact information (read-only)
      </Accordion>

      <Accordion title="Personal profile" icon="user">
        * Update basic profile information
        * Configure personal notifications
        * View personal dashboard
        * Manage personal preferences
        * Access help resources
      </Accordion>

      <Accordion title="Team viewing" icon="users-viewfinder">
        * View team information (read-only)
        * See team members
        * Access basic team resources
        * View team structure
        * See team contact information
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Customer admin">
    <div style={{ marginBottom: '20px' }}>
      <strong>Customer administrators</strong> manage customer-facing portal features and customer organization settings. This role is designed for customers who need administrative control over their portal experience.
    </div>

    <AccordionGroup>
      <Accordion title="Customer portal management" icon="globe">
        * Configure customer portal settings
        * Manage customer-facing features
        * Control customer access and permissions
        * Customize portal branding
        * Set up customer workflows
        * Manage portal integrations
      </Accordion>

      <Accordion title="Customer organization" icon="building-columns">
        * Manage customer organization settings
        * Control customer user access
        * Configure customer workflows
        * Oversee customer integrations
        * Set up customer team structure
        * Manage customer billing preferences
      </Accordion>

      <Accordion title="Customer user management" icon="user-crown">
        * Invite and manage customer users
        * Assign customer user permissions
        * Configure customer user settings
        * Monitor customer user activity
        * Control customer user access levels
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Customer user">
    <div style={{ marginBottom: '20px' }}>
      <strong>Customer users</strong> have access to customer-facing features and their own tickets through the customer portal. This is the standard role for end customers using the platform.
    </div>

    <AccordionGroup>
      <Accordion title="Customer portal access" icon="desktop">
        * Access customer portal interface
        * View customer-specific resources
        * Use customer help center
        * Submit customer requests
        * Access knowledge base articles
        * Use customer communication tools
      </Accordion>

      <Accordion title="Own ticket management" icon="ticket-simple">
        * Create and view own tickets
        * Add comments to own tickets
        * Track ticket progress
        * Access ticket history
        * Receive ticket updates
        * Rate support interactions
      </Accordion>

      <Accordion title="Personal customer profile" icon="user-tag">
        * Update personal profile information
        * Configure notification preferences
        * View personal support history
        * Access personal dashboard
        * Manage personal settings
        * View account information
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

## Role comparison matrix

The following table shows which features are available to each role:

| Feature                     | Org admin | Org user | Lite user | Customer admin | Customer user |
| --------------------------- | --------- | -------- | --------- | -------------- | ------------- |
| **Ticket Management**       |           |          |           |                |               |
| Create tickets              | ✅         | ✅        | ❌         | ❌              | ✅             |
| View all tickets            | ✅         | ✅        | ✅         | ❌              | ❌             |
| View assigned tickets       | ✅         | ✅        | ✅         | ❌              | ✅             |
| Update ticket status        | ✅         | ✅        | ❌         | ❌              | ✅             |
| Assign tickets              | ✅         | ✅        | ❌         | ❌              | ❌             |
| Delete tickets              | ✅         | ❌        | ❌         | ❌              | ❌             |
| Escalate tickets            | ✅         | ✅        | ❌         | ❌              | ❌             |
| **Account Management**      |           |          |           |                |               |
| Create accounts             | ✅         | ✅        | ❌         | ❌              | ❌             |
| View accounts               | ✅         | ✅        | ✅         | ❌              | ❌             |
| Update accounts             | ✅         | ✅        | ❌         | ❌              | ❌             |
| Manage customer contacts    | ✅         | ✅        | ❌         | ❌              | ❌             |
| Add account notes           | ✅         | ✅        | ❌         | ❌              | ❌             |
| **Team Management**         |           |          |           |                |               |
| Create teams                | ✅         | ❌        | ❌         | ❌              | ❌             |
| View teams                  | ✅         | ✅        | ✅         | ❌              | ❌             |
| Add team members            | ✅         | ❌        | ❌         | ❌              | ❌             |
| Configure team settings     | ✅         | ❌        | ❌         | ❌              | ❌             |
| Manage routing rules        | ✅         | ❌        | ❌         | ❌              | ❌             |
| **System Configuration**    |           |          |           |                |               |
| Manage ticket types         | ✅         | ❌        | ❌         | ❌              | ❌             |
| Configure custom fields     | ✅         | ❌        | ❌         | ❌              | ❌             |
| Set up tags                 | ✅         | ❌        | ❌         | ❌              | ❌             |
| Manage forms                | ✅         | ❌        | ❌         | ❌              | ❌             |
| **User Management**         |           |          |           |                |               |
| Send invitations            | ✅         | ❌        | ❌         | ✅              | ❌             |
| Manage user permissions     | ✅         | ❌        | ❌         | ✅              | ❌             |
| Configure notifications     | ✅         | ❌        | ❌         | ✅              | ❌             |
| **Personal Settings**       |           |          |           |                |               |
| Update profile              | ✅         | ✅        | ✅         | ✅              | ✅             |
| Configure preferences       | ✅         | ✅        | ✅         | ✅              | ✅             |
| Set availability            | ✅         | ✅        | ❌         | ❌              | ❌             |
| **Customer Portal**         |           |          |           |                |               |
| Access customer portal      | ❌         | ❌        | ❌         | ✅              | ✅             |
| Configure portal settings   | ❌         | ❌        | ❌         | ✅              | ❌             |
| Use help center             | ❌         | ❌        | ❌         | ✅              | ✅             |
| **Billing & Subscriptions** |           |          |           |                |               |
| View billing                | ✅         | ❌        | ❌         | ❌              | ❌             |
| Manage subscriptions        | ✅         | ❌        | ❌         | ❌              | ❌             |
| Access billing portal       | ✅         | ❌        | ❌         | ❌              | ❌             |

## Common access scenarios

Here are typical scenarios for role assignment and user access management:

<Tabs>
  <Tab title="New team member">
    <div style={{ marginBottom: '20px' }}>
      <strong>Scenario:</strong> A new employee joins your organization and needs access to the platform for daily work.
    </div>

    <Steps>
      <Step title="User registration">
        New employee creates an account or receives an invitation to join the organization
      </Step>

      <Step title="Role assignment">
        Organization admin assigns the **org user** role, providing complete operational access
      </Step>

      <Step title="Team assignment">
        Admin adds the user to relevant teams, granting team-specific access and permissions
      </Step>

      <Step title="Ready to work">
        User can now manage tickets, accounts, and collaborate with team members effectively
      </Step>
    </Steps>

    <Note>
      Most new team members should start with the **org user** role as it provides the right balance of access for daily operations without administrative privileges.
    </Note>
  </Tab>

  <Tab title="Lite user access">
    <div style={{ marginBottom: '20px' }}>
      <strong>Scenario:</strong> A contractor, part-time employee, or external collaborator needs limited access to specific tickets.
    </div>

    <Steps>
      <Step title="Access requirement">
        User needs to view only assigned tickets without full platform access
      </Step>

      <Step title="Lite user assignment">
        Organization admin assigns the **light user** role for restricted access
      </Step>

      <Step title="Ticket assignment">
        Admin assigns specific tickets to the light user for their work
      </Step>

      <Step title="Limited operations">
        User can only view assigned tickets but cannot add comments, update status, or access broader platform features
      </Step>
    </Steps>

    <Warning>
      Lite users have view-only access to assigned tickets. They cannot create tickets, add comments, update statuses, or manage customer contacts. Ensure they have the necessary tickets assigned by an admin.
    </Warning>
  </Tab>

  <Tab title="Administrative promotion">
    <div style={{ marginBottom: '20px' }}>
      <strong>Scenario:</strong> An existing team member is promoted to a management role and needs administrative access.
    </div>

    <Steps>
      <Step title="Current access">
        User currently has **org user** role with operational access
      </Step>

      <Step title="Role upgrade">
        Organization admin promotes the user to **org admin** role
      </Step>

      <Step title="New capabilities">
        User gains access to team management, system configuration, and billing features
      </Step>

      <Step title="Administrative responsibilities">
        User can now manage teams, invite users, configure settings, and oversee organizational operations
      </Step>
    </Steps>

    <Tip>
      Consider providing training on administrative features when promoting users to ensure they understand their new responsibilities and capabilities.
    </Tip>
  </Tab>

  <Tab title="Customer onboarding">
    <div style={{ marginBottom: '20px' }}>
      <strong>Scenario:</strong> External customers need access to submit tickets and track their support requests.
    </div>

    <Steps>
      <Step title="Customer registration">
        Customer creates an account through the customer portal or receives an invitation
      </Step>

      <Step title="Customer user role">
        Customer is automatically assigned the **customer user** role with portal access
      </Step>

      <Step title="Portal access">
        Customer can access the customer portal, submit tickets, and track their requests
      </Step>

      <Step title="Customer admin setup">
        If needed, promote a customer contact to **customer admin** for managing their organization's portal settings
      </Step>
    </Steps>

    <Info>
      Customer users can only see and manage their own tickets. Customer admins can manage multiple customer users and configure portal settings for their organization.
    </Info>
  </Tab>
</Tabs>

## Related resources

<CardGroup cols={2}>
  <Card title="User management" icon="users" href="/platform/core-concepts/organizations/overview">
    Learn about managing users within organizations
  </Card>

  <Card title="Team permissions" icon="user-gear" href="/platform/core-concepts/teams/overview">
    Understand team-level access controls
  </Card>

  <Card title="API authentication" icon="key" href="/api-reference/authentication">
    Implement proper API authentication
  </Card>

  <Card title="Security best practices" icon="shield-check" href="/guides/organization/setup">
    Follow security guidelines for organizations
  </Card>
</CardGroup>