> ## Documentation Index > Fetch the complete documentation index at: https://docs.worldassetregister.com/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > Who can see and do what Access is role based. Every member holds one or more roles, every role is a set of permissions, and every screen and action in the product checks them. Manage roles from **Roles** in the sidebar. Roles ## Built-in roles An **Admin** role that can do everything ships by default and can't be deleted, alongside a starting set covering common needs: a viewer, an editor, and similar. Most organisations extend this set rather than replace it. ## Creating a custom role Open **Roles → New role** for the full editor: Editing a role * **Colour**: shown next to the role wherever it appears, so members can be told apart at a glance in busy lists. * **Permissions**: a categorised catalog (assets, members, policies, reports, billing, and more). Check what this role can do. * **Field access**: per-field control on assets. **Read**, **Request**, or **Write**. *Request* is what powers [change requests](/assets/change-requests). The role can propose a change to that field without being able to save it directly. * **Access scopes**: restrict the role to assets matching a condition (say, only assets at a specific location or in a specific category). Useful for regional managers or contractors who should only see their own patch. * **Parent role**: an optional delegation chain. This role automatically gains everything its parent grants, on top of its own permissions. Build a "Senior editor" once, then set junior roles to inherit from it instead of re-ticking every permission. * **Default role**: the role automatically given to anyone who accepts an invitation with no role specified. ## Choosing what to build A few patterns cover most organisations: * **Viewer**: read everything, write nothing. Good for auditors and stakeholders who need visibility without risk. * **Custodian or site manager**: write access scoped to their own location or department via access scopes, so they can manage what's theirs without touching anyone else's. * **Contractor**: narrow permissions, request-only field access, and an access scope limited to the assets they're actually engaged on. ## Field-level control in practice Field access is where roles and [change requests](/assets/change-requests) meet. Mark cost fields *Request* for a site manager role and *Write* for finance, and site managers can flag a cost correction that finance signs off on, without ever being able to change the number themselves.