> For the complete documentation index, see [llms.txt](https://docs.cybus.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybus.io/2-6-0/access/user-management/roles.md).
# Roles
In Connectware, a role is a named group of permissions that you assign to multiple users at once. Instead of configuring permissions for each user individually, you define a role once and reuse it, which keeps access control consistent as your team changes.
For an explanation of how permissions work and their syntax, see [Permissions](/2-6-0/access/user-management/permissions.md).
## Roles View
The **Roles View** provides a comprehensive dashboard of all defined roles in your Connectware system and their associated permissions. This makes it easy to audit your access control structure and identify which permissions are assigned to each role.
* To open the **Roles View**, click **User** and then click the **Roles** tab.
Roles View in Connectware
In this view, you can quickly identify:
* All available roles in the system.
* The specific permissions assigned to each role.
* Which roles might need modifications based on your security requirements.
## Creating New Roles and Permissions
Creating roles allows you to define permission sets once and apply them to multiple users.
1. In the **Roles View**, click **Add Role** to open the **Create Role** dialog.
Add Role button
2. Enter a name for the new role.
3. Optional: To assign a set of pre-defined permissions to the role, click the **Copy Permissions** field, select a permission, and click **Add**. You can repeat this step to assign multiple permission sets.
4. Optional: To assign individual permissions, click the **+** button to open the **Add Permission** dialog.
* Select the permission type: **HTTP** for accessing the REST API using HTTP clients or **MQTT** for accessing MQTT topics on CybusMQ.
* In the **Endpoint** field, enter the resource path. Wildcards (`+` and `#`) are supported. For syntax details, see [Permissions](/2-6-0/access/user-management/permissions.md).
* Select the access type: **read**, **write**, or **both**.
* Click **Add** to add the permission.
5. Click **Create**. The dialog closes, and the new role appears in the overview table.
## Changing Role Names
To change the name of an existing role:
1. In the **Roles View**, click a role to open the **Edit Role** dialog.
2. In the **Edit Role** dialog, enter a new role name in the **Name** field.
Edit Role dialog
3. Click **Update** to apply the changes. The dialog closes, and the role name is updated.
## Adding Permissions to Roles
You can add individual permissions directly to a role as needed.
1. In the navigation panel, click **User**.
2. Click the **Roles** tab.
3. In the **Roles View**, click the role to which you want to assign permissions. This opens the **Edit Role** dialog.
4. In the **Edit Role** dialog, click the **+** button to open the **Add Permission** dialog.
* Select the permission type: **HTTP** for accessing the REST API using HTTP clients or **MQTT** for accessing MQTT topics on CybusMQ.
* In the **Endpoint** field, enter the resource path. Wildcards (`+` and `#`) are supported. For syntax details, see [Permissions](/2-6-0/access/user-management/permissions.md).
* Select the access type: **read**, **write**, or **both**.
* Click **Add** to add the permission.
5. Click **Update**. The dialog closes, and the role is updated with the new permissions.
The updated role reflects the change immediately, and all users assigned to this role gain the new permissions.
## Removing Permissions from Roles
When specific permissions are no longer needed, you can remove them while keeping other permissions intact.
1. In the navigation panel, click **User**.
2. Click the **Roles** tab.
3. In the **Roles View**, click the role you want to modify to open the **Edit Role** dialog.
4. Permissions are organized into tabs for **HTTP** and **MQTT**. Use the tabs to switch between and manage permissions for each protocol.
5. In the list of assigned permissions, locate the permission you want to remove.
6. Click its **Remove** button in the **Action** column of the permissions list.
7. Click **Update**. The dialog closes, and the role is updated.
The updated role reflects the change immediately, and all users assigned to this role lose the removed permission.
## Deleting Roles
To delete a role:
1. In the **Roles View**, click the role that you want to delete to open the **Edit Role** dialog.
2. Click the **Delete** button in the top right of the **Edit Role** dialog.
Delete Role button
3. Click **Delete** again to confirm. The dialog closes, and the role is deleted.
Delete confirmation
## Built-In Roles
Connectware includes the following predefined roles. They cannot be deleted.
### connectware-admin
Full administrative access to Connectware. This role grants:
* Complete access to all Admin UI pages and actions.
* Read/write access to all MQTT topics and HTTP endpoints.
* The ability to create, modify, and delete users, roles, and permissions.
* Access to all service management operations.
Assign this role only to users who need to administer the full Connectware system. The default `admin` user is created with this role during installation.
### minimum-access
Read-only access to the Admin UI with no data permissions. Users with this role can:
* Log in to the Admin UI and view most pages.
* Not publish or subscribe to any MQTT topics.
* Not call any REST API endpoints beyond those needed to view the Admin UI.
This role is useful as a baseline for users who need visibility into the system without the ability to change anything. It is also the starting point for custom roles with limited scope: create a new role, copy the `minimum-access` permissions, and add only the additional permissions your use case requires.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybus.io/2-6-0/access/user-management/roles.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.