# Roles and permissions

> The full permission catalogue, and how custom roles combine with the built-in three.

Members keep their built-in role (owner, admin or member) **and** can hold
custom roles on top. A custom role is a named bundle of permissions.

Owners and admins short-circuit the check: they hold everything. Custom roles
are how you give a member a specific capability without making them an admin.

## The catalogue

### People

| Permission | Grants |
| --- | --- |
| `member.invite` | Invite members |
| `member.remove` | Remove members |
| `role.manage` | Manage custom roles |
| Assign custom roles | Give an existing role to a member |

### Content

| Permission | Grants |
| --- | --- |
| `blueprint.publish` | Publish blueprints |
| `blueprint.review` | Approve drafts |
| `blueprint.delete` | Delete blueprints |
| `atrium.edit` | Edit the Atrium |
| `folium.edit` | Edit foliums |

### Structure

| Permission | Grants |
| --- | --- |
| `team.create` | Create teams |
| `team.delete` | Delete teams |
| `policy.update` | Edit policies |

### Governance

| Permission | Grants |
| --- | --- |
| `audit.read` | Read the audit log |
| `license.read` | View plan and licence |

### Integrations and platform

| Permission | Grants |
| --- | --- |
| `webhook.manage` | Manage outbound webhooks |
| `integration.manage` | Manage Continuum integrations and cloud connections |
| `sso.manage` | Manage SSO |
| `scim.manage` | Manage SCIM provisioning |
| `network.manage` | Manage network access |

## Designing roles

> [!TIP]
> Build roles around jobs rather than people. "Docs maintainer"
> (`folium.edit` + `blueprint.publish`) survives someone changing team;
> "Sarah's permissions" does not.

Keep the count small. Every role is something a future admin has to understand
before they can safely change anything.