# Roles & Permissions
URL: https://docs.autociso.io/getting-started/roles-and-permissions/
Description: The five organisation roles — Owner, Manager, Contributor, Member and Auditor — what each can do, and how roles combine with your plan, API tokens and role focus.

Every person who signs in to an organisation has exactly one **organisation role**. The role decides what they can see
and change; the organisation's [plan](https://docs.autociso.io/getting-started/plans-and-features/) decides which features exist at all.
Both checks apply to every action.

## The five roles

| Role | In one line | Typical holder |
|---|---|---|
| **Owner** | Full control: users and roles, organisation settings, sign-in policy, integrations, billing and all data. Can invite users to any role. | Founder, CEO, the person accountable for security |
| **Manager** | Runs the programme: creates and manages audits, assets, employees, access reviews, risks and ISO projects, and sees every report. Cannot change organisation settings or billing. | CTO, security or compliance lead, IT manager |
| **Contributor** | Creates and edits assets, employees, evidence and risks. Cannot manage users, integrations or settings, and cannot delete records. | Engineers and IT staff who keep data current |
| **Member** | Performs the access reviews assigned to them and sees data explicitly shared with them. No other write access. | Department heads who review their team's access |
| **Auditor** | Read-only access to all organisation data, reports and exports. Cannot create or change anything. | External or internal auditor |

The descriptions match what the console shows when you invite someone.

## What each role can do

| Action | Owner | Manager | Contributor | Member | Auditor |
|---|:---:|:---:|:---:|:---:|:---:|
| View dashboards and reports | ✓ | ✓ | ✓ | Shared data only | ✓ |
| Import access lists, [correct employee matches](https://docs.autociso.io/product/access/correct-employee-match/) | ✓ | ✓ | — | — | — |
| Add and edit employees, assets, evidence, risks | ✓ | ✓ | ✓ | — | — |
| Delete records | ✓ | ✓ | — | — | — |
| Run lifecycle ([joiner](https://docs.autociso.io/product/lifecycle/onboarding/) and [leaver](https://docs.autociso.io/product/lifecycle/offboarding/)) cases, edit access profiles | ✓ | ✓ | — | — | — |
| [Upload ISO 27001 evidence](https://docs.autociso.io/product/iso/upload-evidence/), run evidence collection | ✓ | ✓ | — | — | — |
| Author and submit a supplier questionnaire | ✓ | ✓ | ✓ | — | — |
| Review and publish a supplier questionnaire | ✓ | ✓¹ | — | — | — |
| View the privacy section (cockpit, records of processing, DPIAs, data dictionary) | ✓ | ✓ | ✓ | ✓ | — |
| Create and edit records of processing and data dictionary entries | ✓ | ✓ | ✓ | — | — |
| Run a DPIA, retire processing activities, export the data dictionary, run a DSAR readiness check | ✓ | ✓ | — | — | — |
| Complete an access review assigned to you | ✓ | ✓ | ✓ | ✓ | — |
| Create and revoke API tokens | ✓ | ✓² | — | — | — |
| Grant the `pii:read` ([employee identity](https://docs.autociso.io/developers/employee-identity/)) scope | ✓ | — | — | — | — |
| Open the Audit Trail | ✓ | ✓ | — | — | — |
| Invite users and change roles | ✓ | — | — | — | — |
| [Reset another user's MFA](https://docs.autociso.io/product/admin/reset-user-mfa/) | ✓ | ✓³ | — | — | — |
| Organization Settings, Sign-In Policy, single sign-on | ✓ | — | — | — | — |
| Billing & Subscription | ✓ | — | — | — | — |

¹ Not for a draft they made the last edit to — see [Supplier questionnaires](https://docs.autociso.io/product/suppliers/questionnaires/).

² Managers can create every scope except `pii:read`. See [API tokens](https://docs.autociso.io/developers/api-tokens/).

³ Not for yourself, and not for a user with a higher role than yours.

Individual feature pages list the exact role for each action where it differs from this summary.

**Tip — Keep two Owners**

Only an Owner can change sign-in settings, restore password sign-in or manage billing. Make sure at least two
people hold the Owner role so a holiday or a lost phone never locks your organisation out.

## Roles you may also see

- **System Owner** and **System Manager** — AutoCISO staff roles for platform support. They are never assigned inside
  your organisation, and System Manager is read-only.
- **Partner Owner** and **Partner Manager** — roles inside a partner firm (for example a fractional CISO) that manages
  several client organisations through the Partner Portal. A client grants a partner access from user menu →
  **Partner Access**.

## How roles interact with other settings

- **Plan.** A role never unlocks a feature your plan does not include, and a plan never lets a role do more. A locked
  menu item shows the plan that includes it.
- **Role focus.** Choosing a [role focus](https://docs.autociso.io/getting-started/role-focus/) such as "CTO" or "Compliance officer" only
  changes what your home screen shows first. It never changes permissions.
- **Single sign-on.** With automatic account creation turned on, people who sign in through your identity provider
  get the role you chose for it — Member, Contributor or Auditor, never Owner or Manager. See
  [How sign-in works](https://docs.autociso.io/product/sso/overview/).
- **API tokens.** A token carries scopes, not a role. It reaches only a short list of endpoints and acts on behalf of
  the organisation. See the [Access model](https://docs.autociso.io/developers/access-model/).

## Change someone's role

1. Open the user menu (your name at the bottom of the sidebar) and choose [**User Management**](https://docs.autociso.io/console/settings/members/).
2. Find the person and edit their role.
3. Save. The change applies on their next request.

Role changes and invitations are recorded in the [Audit Trail](https://docs.autociso.io/product/admin/audit-trail-integrity/).