> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage roles

> Create, edit, and delete workspace roles in the K16 Platform.

Roles bundle permissions so you can give groups of users consistent access. Open **Settings** > **Roles** to review the available roles.

System roles display a **System** badge. You can inspect their permissions, but you cannot rename, edit, or delete them.

Role creation, management, and deletion require their respective **Create**, **Manage**, and **Delete** permissions under **Roles**.

## Create a role

<Steps>
  <Step title="Start a new role">Select **New role**.</Step>

  <Step title="Name the role">
    Enter a concise **Role name** that describes the job the person performs.
  </Step>

  <Step title="Select permissions">
    Expand each permission group and select only the actions the role needs. Selecting a group
    selects all permissions in that group.
  </Step>

  <Step title="Create the role">Review the permission count, then select **Create role**.</Step>
</Steps>

The new role becomes available in the role selector on the **Users** page.

## Edit a custom role

1. Select the role from the list.
2. Change the **Role name** or permission selections.
3. Select **Save changes**.
4. Review users assigned to the role when the change affects access.

<Tip>
  The role list shows how many permission groups and individual permissions are enabled. Use that
  summary to spot roles with unexpectedly broad access.
</Tip>

## Delete a custom role

1. Reassign members who still use the role.
2. Select the role.
3. Select **Delete role** in the toolbar or **Danger zone**.
4. Review the warning, then select **Delete role**.

Deletion cannot be undone. The current role editor tells you to review assigned members after deletion, so reassign them before you confirm.

## Apply least privilege

* Create roles around a job function, not a specific person.
* Separate user administration from SSO, integrations, and data access when different teams own those systems.
* Review custom roles when responsibilities change.
* Keep feature-specific access disabled until the workspace has that feature.

See [Permissions](/administration/roles/permissions) for the current permission catalog.