---
title: "Roles and permissions"
description: "What the Owner, Admin, Project Manager, Project Lead, and Member roles can do in TIR, and how policies limit a Member."
content_type: "concept"
product: "tir-iam"
platform: "TIR"
url: "/tir/tir-iam/concepts/roles-and-permissions/"
topic: ["users-and-access"]
---

# Roles and permissions

TIR uses role-based access control at two levels. The Admin role works at the account level and reaches
every project. The project-level roles, Project Manager, Project Lead, and Member, apply to the
projects a user is assigned to. Permissions pass downward: a role can add users only below its own level.

## How the roles fit together

```mermaid
flowchart TD
    O["Owner"] --> A["Admin"]
    O --> U["User"]
    U --> PM["Project Manager"]
    U --> PL["Project Lead"]
    U --> M["Member"]
```

The Owner sits at the top of the account. Below the Owner, every other person is either an Admin or a User,
the two choices under **Account role** when you add someone. An Admin works at the account level and reaches
every project, so project roles apply only to Users. A User is given one or more projects, with a project
role in each: Project Manager, Project Lead, or Member.

## The roles

### Admin

The Admin role works at the account level, with visibility and control across all projects, users, and resources.

- Full access to every project in the account.
- Can create and manage projects.
- Can invite users and assign roles, except the Admin role.
- Can add, update, or remove members in any project, and manage resource access.
- Can change or remove users below the Admin level only; Admins and the Owner are outside an Admin's control.

### Project Manager

A Project Manager has full control over the assigned projects and can start new projects.

- Full access to all resources in assigned projects.
- Can create projects.
- Can add and manage members at the Project Lead or Member level only.
- Can assign and update policies for members, and manage project settings, including name and description.
- Works only in the projects assigned to them.

### Project Lead

A Project Lead runs day-to-day work in a project: its resources, Members, policies, and settings.

- Full access to resources in the assigned project, and can use every service in it.
- Can invite and add users at the Member level only.
- Can assign and update policies for Members, and manage project settings.
- Works only in the assigned project. Creating projects is for a Project Manager, an Admin, or the Owner.

### Member

The Member role is for contributors who need specific services. The policy you give a Member when you
add them sets their access.

- Can use only the TIR services and actions the policy allows.
- Users, project settings, and membership are managed by the Project Lead and the roles above it.

Every Member needs a policy; see [Policies](/tir/tir-iam/how-to/manage-project-members-and-policies/#policies).

## Role permissions at a glance

| Capability                             | Owner | Admin             | Project Manager      | Project Lead | Member       |
| -------------------------------------- | ----- | ----------------- | -------------------- | ------------ | ------------ |
| Access all projects                    | Yes   | Yes               | No                   | No           | No           |
| Create projects                        | Yes   | Yes               | Yes                  | No           | No           |
| Delete projects                        | Yes   | Yes               | Yes                  | No           | No           |
| Invite users to the account            | Yes   | Yes (below Admin) | Yes (Lead or Member) | Yes (Member) | No           |
| Change or delete users on the IAM page | Yes   | Yes (below Admin) | No                   | No           | No           |
| Change or remove project members       | Yes   | Yes               | Yes (Lead or Member) | Yes (Member) | No           |
| Manage project settings                | Yes   | Yes               | Yes                  | Yes          | No           |
| Create and manage policies             | Yes   | Yes               | Yes                  | Yes          | No           |
| Use project services                   | Yes   | Yes               | Yes                  | Yes          | Yes (policy) |