---
key: create-a-hub-role
title: Create a hub role and choose its permissions
audience: staff
section: enterprise
routes: ["/enterprise/roles"]
permissions: ["hub.users.read"]
features: ["hub.roles"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Make your own role for the enterprise hub team, pick which hub permissions it carries, change it later, and delete it once nobody holds it.
keywords: [hub role, head office role, hub permissions, custom role, regional manager, access level, who can do what in the hub]
related: [add-a-person-to-your-hub-team, give-a-hub-member-a-permission-override, check-what-a-hub-member-can-access, create-a-role]
---

In the sidebar, open **Enterprise Hub**, then **Team & Access**, then **Roles & Permissions**. The page address is `/enterprise/roles`.

Hub roles decide what people can do inside the hub, and only there; an organization's own roles are set inside that organization ([[create-a-role]]). Every hub has eight built-in roles: Hub Owner, Hub Admin, Hub Security Admin, Hub Operations Admin, Hub Finance Admin, Hub Support Admin, Hub Analyst and Hub Read-only. Nova keeps those as they are, so to give a different mix of permissions you create your own.

## Before you start

- Anyone whose hub role can read the hub team can open the page. To create, change or delete roles, your hub role needs permission to manage hub user roles.
- Only hub permissions are listed here, such as reading linked organizations or managing hub message templates.

## Steps

1. Under **Roles**, press **New role**. The **Create new role** panel opens.
2. Type a **Name**. This is the key people type on **Team & Roles**, and it cannot change later. Use lowercase letters, numbers and underscores, starting with a letter, for example `regional_manager`. Names starting with `hub_` are kept for Nova's built-in roles.
3. Type a **Label** people will read and, if it helps, a **Description**.
4. Open **Permissions** and choose. Pick a preset for a whole module (**None**, **Read-only**, **Standard** or **Full access**), or switch single permissions on and off; the module then shows **Custom**. **Search permissions** finds one by name.
5. Press **Create role**. Nova selects the new role under **Role details**.
6. Give it to people on **Team & Roles** ([[add-a-person-to-your-hub-team]]).

To change one of your roles later, pick it under **Roles**, change its **Label**, **Description** or permissions, and press **Save changes**. Nova says **Role updated.**

To delete one of your roles, first take it off everyone on **Team & Roles**. Then pick it, press **Delete role**, and confirm in **Delete role?**.

## What you see

- **Search roles** filters the list by name or label.
- A role created with no permissions gets the same read-only permissions as Hub Read-only.
- Hub roles have no templates, copies, imports or exports, and their order in the list cannot be changed.

## If something looks different

- Saving a built-in role fails with "System roles are immutable": built-in roles cannot be changed, even though the page lets you edit them. Create your own role instead.
- Nova answers a new name with a message about the letters it must match: the name has a dot or a hyphen, or starts with a number. The page's own hint says dots and hyphens are fine, but the hub does not accept them. Use underscores.
- Deleting fails with a message about a replacement role: someone still holds the role. Take it off them on **Team & Roles**, then try again.
- **Default role for new members** can be switched on, but it does not change **Add user**: a person added without roles always gets read-only access.
- **New role** and the switches are greyed out: your hub role can read roles but not change them.

[[route:/enterprise/roles|Open Roles & Permissions]]