> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crovant.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Map Roblox group ranks to Crovant access.

Crovant grants access by **role**, never by individual. Each role corresponds to
a rank in the Roblox group, so promoting someone in Roblox is what gives them
more access here.

## Enable panel access

<Steps>
  <Step title="Open Configuration → Roles & Permissions">
    Every rank imported from the group is listed.
  </Step>

  <Step title="Turn on panel access for staff roles">
    Panel access is the gate: without it a role can sign in but reaches nothing.
  </Step>

  <Step title="Assign permissions per role">
    Grant only what each role needs. Permissions are additive.
  </Step>
</Steps>

<Warning>
  Panel access defaults to **off** for every role, including ones created when
  the workspace was set up. A staff member reporting "I logged in but there's
  nothing there" is nearly always a role without panel access.
</Warning>

## How a request is authorised

Two things are checked, and they fail differently:

<AccordionGroup>
  <Accordion title="Is there a valid session?">
    Sessions come from Roblox OAuth and are signed. No session, or an expired
    one, gives `403 Forbidden` with reason `no_session`.
  </Accordion>

  <Accordion title="Does the role carry the permission?">
    With a valid session but insufficient permissions you get `403 Forbidden`
    with a reason naming what was missing — `not_owner` for owner-only
    operations, `not_superuser` for superuser ones.
  </Accordion>
</AccordionGroup>

## Owners and superusers

Beyond ordinary roles there are two elevated levels:

* **Owner** — the group owner. Can transfer ownership and change any setting.
* **Superuser** — optional; where unset, owners are treated as superusers.

These are configured for the deployment rather than per workspace, and they are
what admin endpoints check.

## Groups within a workspace

Staff can also be collected into groups for assignments and training cohorts.
These are a Crovant concept and do not come from Roblox — they sit alongside
roles rather than replacing them.