> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> A complete reference of what each Enclave role can do — fixed system roles with no per-user customisation.

## Overview

Enclave uses **fixed system roles**. Permissions are defined by role and cannot be customised per user. Every user in the organisation has exactly one role, which determines their access scope across the platform.

Roles are assigned at invite time and can be changed by an Owner (or Org Admin within their scope) at **Organisation → Users**.

***

## Roles

| Role                 | Description                                                                                                              |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Owner**            | Full control — billing, users, org structure, security, and all files. Maximum 3 per organisation.                       |
| **Org Admin**        | Manages an org unit subtree: users, structure, and files within their scope. Major structural changes go through quorum. |
| **Unit Admin**       | Manages a single assigned org unit. Can invite and manage Members within their unit.                                     |
| **Security Officer** | Security configuration, encryption keys, alerts, and audit logs. No file content access (ISO 27001 A.6.1.2).             |
| **Member**           | Standard user. Uploads, downloads, shares, and deletes files within their org unit access.                               |
| **Auditor**          | Read-only access to audit logs and compliance reports. No file content access.                                           |

<Warning>
  Owner has full destructive capability including the ability to delete the organisation. Assign sparingly and limit to primary administrators.
</Warning>

***

## Permissions matrix

Green = full access · Blue = scoped access (see notes) · — = no access

| Capability                | Owner | Org Admin | Unit Admin | Security Officer | Member | Auditor |
| ------------------------- | :---: | :-------: | :--------: | :--------------: | :----: | :-----: |
| **Manage users**          |   ✅   |     🔵    |     🔵     |         —        |    —   |    —    |
| **Change roles**          |   ✅   |     🔵    |      —     |         —        |    —   |    —    |
| **Invite users**          |   ✅   |     🔵    |     🔵     |         —        |    —   |    —    |
| **Manage org structure**  |   ✅   |     🔵    |      —     |         —        |    —   |    —    |
| **Create sub-units**      |   ✅   |     🔵    |     🔵     |         —        |    —   |    —    |
| **Files & storage**       |   ✅   |     🔵    |     🔵     |         —        |    ✅   |    —    |
| **KMS / Encryption keys** |   ✅   |     —     |      —     |         ✅        |    —   |    —    |
| **Security alerts**       |   ✅   |     —     |      —     |         ✅        |    —   |    —    |
| **Audit logs**            |   ✅   |     —     |      —     |         ✅        |    —   |    ✅    |
| **Billing & plans**       |   ✅   |     —     |      —     |         —        |    —   |    —    |

### Scoped access notes

| Role       | Capability           | Scope                                                    |
| ---------- | -------------------- | -------------------------------------------------------- |
| Org Admin  | Manage users         | Within their org unit subtree only                       |
| Org Admin  | Change roles         | Can assign Unit Admin or Member — not Owner or Org Admin |
| Org Admin  | Invite users         | Can invite Member or Unit Admin                          |
| Org Admin  | Manage org structure | Via quorum approval for major changes                    |
| Org Admin  | Create sub-units     | Via quorum approval request                              |
| Org Admin  | Files & storage      | Files within their org unit tree                         |
| Unit Admin | Manage users         | Members in their unit only                               |
| Unit Admin | Invite users         | Can invite Members only                                  |
| Unit Admin | Create sub-units     | Directly within their unit (no quorum required)          |
| Unit Admin | Files & storage      | Files within their unit                                  |

<Note>
  Security Officers have **no file access** by design. This enforces separation of duties — the person who can view all audit events and manage encryption keys cannot also read file contents. This is an ISO 27001 A.6.1.2 control.
</Note>

***

## Default clearance by role

Each role carries a default clearance level. Individual users can be overridden above or below this default at **Organisation → Users → Set Clearance**.

| Role             | Default clearance |
| ---------------- | ----------------- |
| Owner            | C4                |
| Org Admin        | C4                |
| Security Officer | C4                |
| Unit Admin       | C3                |
| Member           | C2                |
| Auditor          | C2                |

See [Clearance Levels](/organization/clearance) for how clearance interacts with file classification and DLP policies.

***

## Org unit roles

In addition to their organisation-wide role, users can hold a **membership role** within each org unit they belong to. These are independent of the system role above.

| Membership role | Access within the org unit        |
| --------------- | --------------------------------- |
| **Manager**     | Can manage unit files and members |
| **Contributor** | Upload and edit files             |
| **Viewer**      | Read-only file access             |

Membership roles are set per-unit at **Organisation → Users → Manage memberships**. A Member with organisation-wide role "Member" can hold Manager-level access in one unit and Viewer-level access in another.

<Note>
  Owner and Org Admin roles do **not** grant implicit file access to org units. Admins must hold explicit membership in an org unit to access files in rooms owned by that unit.
</Note>

See [Org Units](/organization/org-units) for full membership management documentation.