> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mercora.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Every member has one role, which sets what they can view and change in each area of Mercora.

Every member has one **role**: a set of permissions, one per area of Mercora. This page explains the built-in roles and how to create your own under **Settings → Roles**, which is for workspace admins.

A role only opens areas whose [module](https://docs.mercora.io/concepts/modules.md) is turned on, so set up your modules first.

## Permission levels

* **None**: the area is hidden.
* **View**: the member can see the area but not change it.
* **Edit**: the member can make changes: upload, correct, match, approve, create and so on.

**Dashboard** and **Reports** only go up to **View**. **Copilot** is **None** or **Use**.

## Built-in roles

| Role | Access |
| - | - |
| **Admin** | Everything, plus members, roles, settings, modules, integrations and API keys. |
| **Operator** | **Edit** on every area except **User access**, **Email** and **Files**. |
| **Viewer** | **View** on every area (and **Use** for the Copilot) except **User access**, **Email** and **Files**. |

**User access**, **Email** and **Files** are left out on purpose: managing members and acting in the workspace's shared mailboxes and files are things an admin grants deliberately. You can adjust a built-in role's permissions, but not delete it or change whether it's an admin role.

## Create a custom role

**1. Click New role**

Go to **Settings → Roles** and click **New role**. Give it a **Name**, such as "Trade finance", and optionally a **Description**.

**2. Choose a starting point**

Under **Copy permissions from**, pick **No access — start empty** or an existing role. Copying happens once and never turns on **Workspace admin**.

**3. Set each permission**

Choose **None**, **View** or **Edit**. Use **Set all to...** for a whole group, or **Search permissions...** to find one.

**4. Click Create role**

Then assign it to members under [Members](https://docs.mercora.io/admin/members.md).

![The New role dialog with the permission grid](https://mintcdn.com/placeholder-f4ffdeec/22McaegbdDRSI41b/images/concepts/new-role-dialog.png?fit=max\&auto=format\&n=22McaegbdDRSI41b\&q=85\&s=a742a271e8cf847e7459cebe538603e8)

A new role, starting empty. Invoice sync shows a Module off badge and stays greyed out until Documents is at least View.

An indented permission only takes effect while its parent is at least **View**. A permission whose module is off shows **Module off**; you can still set it for later.

To delete a custom role that members still use, choose a role to **Move members to** first.

## What each permission covers

| Permission | Covers |
| - | - |
| **Dashboard** | Overview cards on Home. |
| **Documents** | Upload, review and approve documents. Indented under it: **Invoice sync**, **B/L sync** and **Contract sync** to a connected system. |
| **Trades** | Trade list, details, legs and reconciliation. |
| **Contracts** | Contracts as standalone records. |
| **Shipments & logistics** | Shipments, containers, vessels and the trade's Shipments tab. |
| **Financials** | Invoices, payments, settlements, netting and the cost & income plan. |
| **Counterparties** | Counterparty records, KYC, terms and balances. |
| **Derivatives** | The futures ledger. |
| **Reports** | Analytics, the P\&L and the overdue-payments report. |
| **Deal Capture**, **Freight Rates**, **Hedging** | Each workflow's items in the Inbox. Deal Capture and Hedging each have an **External sync** permission. |
| **Automations — management** | Create, edit and run automations. |
| **Automations — results** | Read and act on automation results. |
| **Copilot** | Use the assistant, limited to what the role can already reach. |
| **Email** | Read connected mailboxes and Teams channels. **Edit** also sends and posts, each after an **Approve**. |
| **Files** | Read connected SharePoint files and spreadsheets. **Edit** also changes them, each after an **Approve**. |
| **User access** | **View** shows Members and Roles. **Edit** also lets the member change others' roles, within limits. |

Some features need more than one: pushing an invoice to an external system needs **Edit** on **Documents** and **Invoice sync**, plus both modules on.

## Admins

Turning on **Workspace admin** for a role gives full access everywhere and ignores the permission grid.

Mercora won't let you lose your last admin: you can't demote or remove them, turn off **Workspace admin** on their only role, or delete it. Make someone else an admin first.

## Next steps

* [Members](https://docs.mercora.io/admin/members.md): invite teammates and give each a role.
* [Modules](https://docs.mercora.io/concepts/modules.md): turn on the areas your roles grant.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.