zitadel/site/docs/administrate/05-roles.en.md

title
Roles

What are Roles

ZITADEL lets projects define their role based access control.

Roles can be consumed by the clients which exist within a specific project.

For more information about how roles can be consumed, have a look the protocol specific information.

• OpenID Connect / OAuth

Manage Roles

Each role consist of three fields.

Field	Description	Example
Key	This is the Roles actual name which can be used to verify the users roles.	User
Display Name	A descriptive text for the purpose of the Role	User is the default role provided to each person
Group	The group field allows to group certain roles who belong in the same context	User and Admin in the group default

Granting Roles

To give someone (or somewhat) access to a project's resources and services ZITADEL provides two processes: Roles can either be granted to users or to organisations.

Grant Roles to Organisations

The possibility to grant roles to an organisation is intended as "delegation" so that a organisation can on their own grant access to users.

For example a service provider could grant the roles user, and manager to an organisation as soon as they purchases his service. This can be automated by utilising a service user in the service providers business process.

Screenshot here

Grant Roles to Users

By granting roles to users, be it humans or machines, this user receives the authorization to access a project's resources.

Screenshot here