---
title: "Choose a role for a user"
description: "Compare the six MyAccount roles, see who can change a role, and find out whether you can limit a user to a single server."
content_type: "how-to"
product: "account"
platform: "MyAccount"
url: "/myaccount/account/how-to/choose-a-role-for-a-user/"
topic: ["users-and-access"]
---

# Choose a role for a user

Every user on your account has one of six roles, and the role decides what they can reach:
projects and resources, billing, and other users. Pick the role when you invite or edit someone.

## Before you begin

You need to be an **Admin** or a **Project Lead**. Only these two roles can
set another user's role; see [Who can change a role](#who-can-change-a-role).

## The six roles

| Role                 | Projects and resources                        | Billing     | Other users                                                       |
| -------------------- | --------------------------------------------- | ----------- | ----------------------------------------------------------------- |
| **Admin**            | Full access to every project and resource     | Full access | Can add or edit any user except the owner, including other Admins |
| **Project Lead**     | Full access to every project and resource     | No access   | Can add or edit a Project Lead or a Member only                   |
| **Billing**          | No access                                     | Full access | Cannot add or edit any user                                       |
| **Member**           | Only the projects and policies you give them  | No access   | Cannot add or edit any user                                       |
| **Billing + Member** | Only the projects and policies you give them  | Full access | Cannot add or edit any user                                       |
| **Viewer**           | Read-only access to every project's resources | No access   | Cannot add or edit any user                                       |

**Billing**, **Member**, and **Billing + Member** users do not see **Identity & Access Management
(IAM)** in the account menu. A **Viewer** can open IAM and see its lists, but cannot change
anything there: there is no **Add User**, and no actions on any row.

Neither **Member** nor **Billing + Member** has a per-user spending limit: a policy controls what a
user can see and do, never how much they can spend. For what a policy sets, see
[Create a policy set](/myaccount/account/how-to/create-a-policy-set/).

**Owner** is not a role you assign. It belongs only to the person who created the account, and it
does not appear in this list. The **Edit** screen cannot change who the owner is; see
[Change the account owner](/myaccount/account/how-to/change-the-owner-email/).

## Who can change a role

Only an **Admin** or a **Project Lead** can add or edit another user's role. An **Admin** can set
any of the six roles, and a **Project Lead** can
set only **Project Lead** or **Member**. An edit outside that is refused, naming either the
user's current role or the role you tried to set.

Setting a user to **Member** or **Billing + Member** needs at least one **User Group**, or at least
one project with a policy chosen for it. Choose a policy for every project you select; MyAccount
refuses a selected project that has none.

## Can I give someone access to only one server?

No. The services you tick in a policy cover a whole project, and a policy has no field to name a
single server or other resource inside it.

To limit someone to one server, put that server in a project of its own, and add the user to only
that project. See [Create a project](/myaccount/account/how-to/create-a-project/) and
[Give an existing user access to another project](/myaccount/account/how-to/manage-users/#give-an-existing-user-access-to-another-project).

With the role chosen, set it when you [invite a user](/myaccount/account/how-to/invite-a-user/), or
change it from **Edit** in [Manage users](/myaccount/account/how-to/manage-users/).