# Roles
> **Note:** This capability is currently in Early Access (EA) and is not generally available. To request access, contact OX technical support.
Roles define what users can view and do in OX by combining page access and action permissions, so you can align platform access with organizational responsibilities.
OX provides [built-in immutable roles](#built-in-roles) and the ability to define [custom roles](#custom-roles) that match your organization’s structure.
## How permissions work
Permissions in OX are structured and interdependent.
Access is defined in two layers:
* Page permissions determine whether a page appears in navigation.
* Action permissions determine what can be done inside that page.
Actions only work when the related page permission is selected. If page access is not granted, the page is hidden, and its actions cannot be used. For example, if the View Issues permission is not selected, actions such as Fix issue, Open PR, or Create Tickets cannot be performed.
When creating a role, always select the required page permissions first, then enable the necessary actions.
## Built-in roles
OX includes predefined roles for common responsibilities.
| Role | Intended use |
| -------------- | ----------------------------------------- |
| Admin | Full access across the platform |
| Policy Manager | Manage and enforce policies |
| Developer | Investigate and remediate issues |
| Read Only | View platform data without making changes |
## Custom roles
Custom roles allow you to enforce least-privilege access and clearly separate operational responsibilities across teams. By defining granular page and action permissions, you can restrict exposure to sensitive configuration areas while granting teams only the access required for their function.
You can define custom roles from scratch or by duplicating and editing existing roles.
**To duplicate an existing role:**
1. Go to **Settings > Roles**.
2. Click the three dots next to the role you want to duplicate and select **Duplicate**.\
The **Edit Role** page appears with all the role settings defined for the role you selected.
3. [Edit the role settings](#permissions-reference) and select **Update Role**.
**To create a role from scratch:**
1. Go to **Settings > Roles**.
2. Select **Create Role**.
3. Enter a role name and optional description.
4. Select the required [page permissions and actions](#permissions-reference) you want to allow.
5. Select **Create Role**.
Review the role before saving to ensure all required page permissions are included.
**To assign users to a role:**
1. Go to **Settings > Users**.
2. Select a user.
3. Select **Edit user (role/scope)**.
4. Choose a role.
5. Select **Save**.
## Permissions reference
The following table reflects the current roles configuration model, including permission dependencies.
| Area | Permission | What it allows | Prerequisite Permissions |
| ---------------------------------- | ---------------------------------------------------------- | ----------------------------------------------------- | --------------------------------------- |
| General | Initiate scan | Run regular scans | |
| Dashboard | View dashboard | Allows viewing the Dashboard page | View issues |
|
.png?alt=media)