# The Roles manual

<!-- module: s4-roles · deck: Roles are a workspace's own: rename them, make new ones, give them to people; nobody gives more than they hold, and nobody changes their own access. -->

**Table of contents · 24 October 2026 · S4 of plan CORE. Since S8, every change asks for your password again first (step-up, the Sign-in manual), and a role can require two-factor sign-in (the switch on its page). Since 25 October 2026 the account holder's role
requires it while the platform does (as shipped): its page says "required by the platform" and has no switch.**

A role is a set of permissions with a name. Every workspace starts with three (Owner, Admin, Member), renames them as
it likes, and makes its own. People hold roles in each workspace they belong to.

The one sentence to carry through it: **nobody gives what they don't hold, and nobody changes their own access.**

**Who meets what**

| Seat | Who | What they do here |
|---|---|---|
| Owner | The workspace's one account holder | Everything; hands the workspace over |
| Admin | Someone whose role may manage roles or give them | Makes and changes roles, gives people roles, within their own reach |
| Service | The platform's owner | Reads the standard roles every workspace starts with |

---

## Part 1 · Roles

- [1.1 Giving someone a role](p01-roles.md#11-giving-someone-a-role)
- [1.2 Making a role](p01-roles.md#12-making-a-role)
- [1.3 Changing what a role can do](p01-roles.md#13-changing-what-a-role-can-do)
- [1.4 Why a permission isn't listed, or a role opens only to read](p01-roles.md#14-why-a-permission-isnt-listed-or-a-role-opens-only-to-read)
- [1.5 Handing over ownership](p01-roles.md#15-handing-over-ownership)
- [1.6 The standard roles (Service)](p01-roles.md#16-the-standard-roles-service)