> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Each member has a role in each organization. Roles decide who can view, act, configure and manage people.

## Built-in roles

A member's role is set per organization, so someone can be an admin in one organization and a viewer in another. From least to most access:

| Role | What it adds |
| - | - |
| **Viewer** | Read-only access to the organization's findings, dashboards and settings they're allowed to see. |
| **Member** | Viewer, plus running actions: start scans, create tickets, comment and triage. |
| **Manage** | Member, plus day-to-day configuration: integrations, AI providers, workflow rules and scan credentials. |
| **Admin** | Manage, plus people, money and policy: invite and remove members, change roles, SLA policies, billing, security policy and deleting the organization. |
| **Owner** | Admin, plus transferring ownership to another member. |
| **Enterprise admin** | Manages members and settings across all the organizations in an Enterprise account. |

New accounts are the admin of the organization created for them.

## Permission matrix

| Action | Viewer | Member | Manage | Admin | Owner |
| - | :-: | :-: | :-: | :-: | :-: |
| View findings, Workbench and dashboards | ✓ | ✓ | ✓ | ✓ | ✓ |
| Start scans, create tickets, triage findings | | ✓ | ✓ | ✓ | ✓ |
| Configure integrations and AI providers | | | ✓ | ✓ | ✓ |
| Set workflow rules | | | ✓ | ✓ | ✓ |
| Set SLA policies | | | | ✓ | ✓ |
| Invite and remove members, change roles | | | | ✓ | ✓ |
| Manage billing and security policy | | | | ✓ | ✓ |
| Delete the organization | | | | ✓ | ✓ |
| Transfer ownership | | | | | ✓ |

## Custom roles

> [!NOTE]
>
> Custom roles are available on the Enterprise plan.

If the built-in roles don't fit your team, an Enterprise account can define custom roles with their own set of permissions. Contact [support](mailto:contact@tierity.com) to set them up for your account.

## Two-factor authentication

Every user can add an authenticator app under **Profile → Security**.

To require it for everyone in an organization, an admin turns on **Require 2FA** under **Config → Team**. Members without two-factor authentication are taken to the setup page the next time they sign in.

On the Enterprise plan, an enterprise admin can also require 2FA for individual people from **Enterprise Config**.

## Single sign-on (SSO)

> [!NOTE]
>
> SSO is available on the Enterprise plan.

Tierity's SSO is built on WorkOS and works with Okta, Microsoft Entra ID, Google Workspace and any SAML 2.0 or OIDC identity provider. Contact [support](mailto:contact@tierity.com) to connect your identity provider.

Once SSO is connected, an enterprise admin can require it for individual people from **Enterprise Config**. Someone who must use SSO can't sign in with a password or an emailed code; Tierity sends them to your identity provider instead.

## API keys

API keys are created and revoked from **Config → General → API Keys**. Enterprise admins can revoke any member's keys from **Enterprise Config**. See [API authentication](https://docs.tierity.com/api-reference/authentication.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.