> For the complete documentation index, see [llms.txt](https://docs.strongdm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.strongdm.com/admin/access/roles.md). # Roles Roles, when assigned to users, provide users with access to resources. A role is a collection of permissions that are granted to the users that are assigned to that role. ## Role and Permission Assignment In the Admin UI, you can assign roles to users from the user's details in **Principals** > **Users**. Select the user's name from the list, click the **Roles** tab, search your roles list, and add them. In the CLI, you can use the `sdm admin users` command to add roles. {% hint style="info" %} Note that users in the **Suspended** role cannot log in or access any resources. {% endhint %} To add permissions to a role, use [access rules](#access-rules). Access rules provide two methods by which to assign access permissions to a role. Static access rules are manually assigned permissions. Dynamic access rules provide permissions for resources based on tags and resource types chosen. ## Sort and Filter Roles Once roles are created and assigned to users, they are shown in the Admin UI in **Principals** > **Roles**. You can sort the table of roles in your organization by clicking on column headers. Clicking a column header sorts the table by the values in that column, in ascending order. Clicking again on the same header reverses the sorting direction. You can use the **Managed by** filter to view all roles or only those managed by StrongDM or via SCIM. Select **Any**, **StrongDM**, or **Generic SCIM**. ## View Role Details Select a role from the list to view its details. Then manage the role by using the tabs shown at the top of the screen. These tabs are: * **Access Rules** * **Conditions** * **Entitlements** * **Groups** * **Members** * **Settings** ### Access Rules Use access rules to add permissions to a role. Access rules provide two methods by which to assign access permissions to a role. Static access rules are manually assigned permissions. Dynamic access rules provide permissions for resources based on tags and resource types chosen. #### Access rule editor Access rules are the building blocks of roles. You can add, edit, or delete access rules within a role. Navigate to the **Principals** > **Roles** page, and then look at a role (or create a new one). To edit an existing access rule, click **edit**. To delete an access rule, click **edit** and once the Edit view is open, click **Delete Access Rule**. Each role can comprise up to 10 access rules. The access rule editor can create both static access rules and dynamic access rules. #### Static access rules Static access rules are the method by which you can assign access to specific resource(s) to a role, one at a time from a list of checkboxes. You can select up to 2000 resources per rule. #### Dynamic access rules Dynamic access rules provide the tool set to dynamically assign resource access to members of the role. Each dynamic access rule is made up of two properties: * **Resource type**: You can choose a specific type of resource, such as a MySQL databases or EKS clusters, or you can choose **All resource types**. * **Resource tags**: Tags are key-value pairs assigned to resources. A Dynamic rule can add tags using Basic or Advanced mode. * **Basic**: Add tags in key-value pairs, one at a time. An access rule may include up to 20 tags. * **Advanced**: Add tags using expressions, which can include AND, OR, NOT, and parentheses operators. The following are examples: * `env=prod AND cloud=azure1`, where the resource must have both tags set with the specified values * `(env=demo-1 OR env=demo-3) AND NOT private=true`, where the resource must have the tag `env` with a value `demo-1` or `demo-3`, and the resource must also not have the tag `private=true` {% hint style="info" %} A dynamic access rule will grant access to all resources that meet **all** of the criteria specified in its properties. Dynamic access rules are an "and" relationship internally, not "or." For example, specifying one database type and two tags will grant access only to resources that are of that database type and have both of those tags. {% endhint %} The access rule editor indicates if there are no resources that currently match your criteria. If there are matching resources, it indicates how many. ### Conditions {% hint style="info" %} This feature is part of the Secure AI offering. If it is not enabled for your organization and you would like it to be, please contact your StrongDM/Delinea representative for more information. {% endhint %} If Secure AI is enabled for your organization, the **Conditions** tab is shown. The **Conditions** tab lets you restrict a role so that it applies only to actions initiated by specific AI agent types. You can select either **All tools** or **Specific Agents**. To learn more about Secure AI, please see [AI Attribution](/ai/ai-attribution.md). ### Entitlements From the **Entitlements** tab, you can see what entitlements a particular role gives. For more information, please see [Entitlements Visibility](/admin/access/entitlements-visibility.md). ### Groups From the **Groups** tab, you can view the groups that a particular role is a member of. For more information, please see [Groups](/admin/principals/groups.md). ### Members From the **Members** tab, you can view the users and service accounts that are assigned to the particular role. Accounts assigned to the role receive its permissions. ### Settings Use the **Settings** tab to change the name of the role, or delete the role. Deleted roles are removed from the list of roles but the logs are not affected. ## Recommended Reading {% content-ref url="/pages/7m2IJOwwpEY0AX2wf3yr" %} [Import Roles](/admin/access/import-roles.md) {% endcontent-ref %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.strongdm.com/admin/access/roles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.