Roles & Permissions
Every person who signs in to an organisation has exactly one organisation role. The role decides what they can see and change; the organisation’s plan decides which features exist at all. Both checks apply to every action.
The five roles
| Role | In one line | Typical holder |
|---|---|---|
| Owner | Full control: users and roles, organisation settings, sign-in policy, integrations, billing and all data. Can invite users to any role. | Founder, CEO, the person accountable for security |
| Manager | Runs the programme: creates and manages audits, assets, employees, access reviews, risks and ISO projects, and sees every report. Cannot change organisation settings or billing. | CTO, security or compliance lead, IT manager |
| Contributor | Creates and edits assets, employees, evidence and risks. Cannot manage users, integrations or settings, and cannot delete records. | Engineers and IT staff who keep data current |
| Member | Performs the access reviews assigned to them and sees data explicitly shared with them. No other write access. | Department heads who review their team’s access |
| Auditor | Read-only access to all organisation data, reports and exports. Cannot create or change anything. | External or internal auditor |
The descriptions match what the console shows when you invite someone.
What each role can do
| Action | Owner | Manager | Contributor | Member | Auditor |
|---|---|---|---|---|---|
| View dashboards and reports | ✓ | ✓ | ✓ | Shared data only | ✓ |
| Import access lists, correct employee matches | ✓ | ✓ | — | — | — |
| Add and edit employees, assets, evidence, risks | ✓ | ✓ | ✓ | — | — |
| Delete records | ✓ | ✓ | — | — | — |
| Run lifecycle (joiner and leaver) cases, edit access profiles | ✓ | ✓ | — | — | — |
| Upload ISO 27001 evidence, run evidence collection | ✓ | ✓ | — | — | — |
| Author and submit a supplier questionnaire | ✓ | ✓ | ✓ | — | — |
| Review and publish a supplier questionnaire | ✓ | ✓¹ | — | — | — |
| View the privacy section (cockpit, records of processing, DPIAs, data dictionary) | ✓ | ✓ | ✓ | ✓ | — |
| Create and edit records of processing and data dictionary entries | ✓ | ✓ | ✓ | — | — |
| Run a DPIA, retire processing activities, export the data dictionary, run a DSAR readiness check | ✓ | ✓ | — | — | — |
| Complete an access review assigned to you | ✓ | ✓ | ✓ | ✓ | — |
| Create and revoke API tokens | ✓ | ✓² | — | — | — |
Grant the pii:read (employee identity) scope |
✓ | — | — | — | — |
| Open the Audit Trail | ✓ | ✓ | — | — | — |
| Invite users and change roles | ✓ | — | — | — | — |
| Reset another user’s MFA | ✓ | ✓³ | — | — | — |
| Organization Settings, Sign-In Policy, single sign-on | ✓ | — | — | — | — |
| Billing & Subscription | ✓ | — | — | — | — |
¹ Not for a draft they made the last edit to — see Supplier questionnaires.
² Managers can create every scope except pii:read. See API tokens.
³ Not for yourself, and not for a user with a higher role than yours.
Individual feature pages list the exact role for each action where it differs from this summary.
Roles you may also see
- System Owner and System Manager — AutoCISO staff roles for platform support. They are never assigned inside your organisation, and System Manager is read-only.
- Partner Owner and Partner Manager — roles inside a partner firm (for example a fractional CISO) that manages several client organisations through the Partner Portal. A client grants a partner access from user menu → Partner Access.
How roles interact with other settings
- Plan. A role never unlocks a feature your plan does not include, and a plan never lets a role do more. A locked menu item shows the plan that includes it.
- Role focus. Choosing a role focus such as “CTO” or “Compliance officer” only changes what your home screen shows first. It never changes permissions.
- Single sign-on. With automatic account creation turned on, people who sign in through your identity provider get the role you chose for it — Member, Contributor or Auditor, never Owner or Manager. See How sign-in works.
- API tokens. A token carries scopes, not a role. It reaches only a short list of endpoints and acts on behalf of the organisation. See the Access model.
Change someone’s role
- Open the user menu (your name at the bottom of the sidebar) and choose User Management.
- Find the person and edit their role.
- Save. The change applies on their next request.
Role changes and invitations are recorded in the Audit Trail.
Last reviewed: 2026-10-24
Was this page helpful?