--- title: "TIR Access Control FAQ" description: "Short answers about roles, invitations, policies, and Audit Logs in TIR." content_type: "faq" product: "tir-iam" platform: "TIR" url: "/tir/tir-iam/faq/" --- # TIR Access Control FAQ ## Roles ### Which role should I give a new teammate? The smallest one that covers their work. A Member uses the services a policy lists, a Project Lead runs a project and adds Members, a Project Manager also creates projects, and an Admin runs every project. See [Roles and permissions](/tir/tir-iam/concepts/roles-and-permissions/). ### Can I change or remove the Owner? No. The Owner has access to every project and user, and no other role can change, reassign, or remove the Owner. ### Can an Admin add another Admin? No. Only the Owner can add, change, or remove Admins. See [Add a user](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/#add-a-user). ### Does an Admin need a project role or a policy? No. An Admin reaches every project, so the **Add user** panel skips projects and policies for an Admin. ### Can a person have a different role in each project? Yes. A User is given each project separately, with a role in each: Project Manager, Project Lead, or Member. See [Manage users in IAM](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/). ### Can a Project Lead create a project? No. The Owner, an Admin, and a Project Manager can create projects. A Project Lead can change a project's name and description. See [Roles and permissions](/tir/tir-iam/concepts/roles-and-permissions/). ### Why can I not change some people on the IAM page? **Update access** and **Delete user** appear only on people whose role is below yours, so the Owner and Admins make those changes. A Project Manager or Project Lead can change project members on the project's **Project Members** tab. See [Manage project members and policies](/tir/tir-iam/how-to/manage-project-members-and-policies/). ## Policies ### Does a Member need a policy? Yes. Every Member has at least one policy, and it decides which services they can use in the project. See [Policies](/tir/tir-iam/how-to/manage-project-members-and-policies/#policies). ### Can one policy cover several projects? No. A policy belongs to one project. Create a policy in each project where you need one. ### What can a policy allow? For each service you choose, any of **Read**, **Create**, **Update**, and **Delete**. **Select All Services** ticks every service at once. See [Create a policy](/tir/tir-iam/how-to/manage-project-members-and-policies/#create-a-policy). ### What happens to Members when I delete their policy? They lose the access that policy gave them. Give them another policy before you delete it. See [Delete a policy](/tir/tir-iam/how-to/manage-project-members-and-policies/#delete-a-policy). ### Who can see the Policies tab? The Owner, an Admin, a Project Manager, and a Project Lead. The tab is hidden from Members. ## Invitations ### What if an invitation expires? Its status on **Invited users** changes to **Expired**. Select **Resend invitation** to send a new link. See [Send an invitation again](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/#send-an-invitation-again). ### Can I invite an email address twice? No. TIR refuses an address that already has an invitation, or that already belongs to a person in the account. Resend the existing invitation, or give the existing person more projects with **Update access**. ### Where does an invited person find the invitation? In TIR, under **Show my invitations** in the account menu at the top right. A person who is new to E2E registers from the email first. See [What the invited person does](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/#what-the-invited-person-does). ### Can one person work in several accounts? Yes. A person invited to your account who also has an account of their own switches between the two under **Switch account** in the account menu at the top right. ## Removing people ### Does deleting a user in TIR remove them from MyAccount? No. It removes them from TIR only. Deleting them in MyAccount removes them from both. See [Remove a person](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/#remove-a-person). ### Do a removed person's SSH keys stay on my resources? Yes. SSH keys a person attached to your resources stay on them when you remove the person from the account or from a project. Remove the keys from each resource yourself. ### What happens when I delete a project? Every resource in the project is permanently deleted, in every region. See [Update or delete a project](/tir/projects/how-to/update-or-delete-a-project/). ## Teams and audit logs ### Can I manage teams? No. Projects sit directly under your account, and you manage access in each project. See [Access without teams](/tir/tir-iam/concepts/access-without-teams/). ### Where are Audit Logs, and can I export them? **Audit Logs** is in the account menu at the top right. Filter by service and interval, then select **Export as CSV** to download the list. See [View Audit Logs](/tir/tir-iam/how-to/view-audit-logs/).