Choose a role for a user

Every user on your account has one of six roles, and the role decides what they can reach: projects and resources, billing, and other users. Pick the role when you invite or edit someone.

Before you begin

You need to be an Admin or a Project Lead. Only these two roles can set another user’s role; see Who can change a role.

The six roles

Role	Projects and resources	Billing	Other users
Admin	Full access to every project and resource	Full access	Can add or edit any user except the owner, including other Admins
Project Lead	Full access to every project and resource	No access	Can add or edit a Project Lead or a Member only
Billing	No access	Full access	Cannot add or edit any user
Member	Only the projects and policies you give them	No access	Cannot add or edit any user
Billing + Member	Only the projects and policies you give them	Full access	Cannot add or edit any user
Viewer	Read-only access to every project’s resources	No access	Cannot add or edit any user

Billing, Member, and Billing + Member users do not see Identity & Access Management (IAM) in the account menu. A Viewer can open IAM and see its lists, but cannot change anything there: there is no Add User, and no actions on any row.

Neither Member nor Billing + Member has a per-user spending limit: a policy controls what a user can see and do, never how much they can spend. For what a policy sets, see Create a policy set.

Owner is not a role you assign. It belongs only to the person who created the account, and it does not appear in this list. The Edit screen cannot change who the owner is; see Change the account owner.

Who can change a role

Only an Admin or a Project Lead can add or edit another user’s role. An Admin can set any of the six roles, and a Project Lead can set only Project Lead or Member. An edit outside that is refused, naming either the user’s current role or the role you tried to set.

Setting a user to Member or Billing + Member needs at least one User Group, or at least one project with a policy chosen for it. Choose a policy for every project you select; MyAccount refuses a selected project that has none.

Can I give someone access to only one server?

No. The services you tick in a policy cover a whole project, and a policy has no field to name a single server or other resource inside it.

To limit someone to one server, put that server in a project of its own, and add the user to only that project. See Create a project and Give an existing user access to another project.

With the role chosen, set it when you invite a user, or change it from Edit in Manage users.