---
key: create-a-role
title: Create a role and choose its permissions
audience: staff
section: administration/team-access
routes: ["/settings/org/rbac/roles"]
permissions: ["rbac.roles.read"]
features: ["settings.org.rbac"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Make a role for a kind of team member, starting from a built-in role or from scratch, pick its permissions with module presets or one at a time, and save it.
keywords: [permissions, role, access level, who can see what, technician permissions, office role, admin role, restrict access, template role, custom role]
related: [choose-a-built-in-role, add-a-team-member, change-a-team-members-roles, give-a-user-a-permission-override, check-what-a-user-can-access]
---

In the sidebar, open **Administration**, then choose **Roles & Permissions** under **Team & Access**. The page address is `/settings/org/rbac/roles`.

A role is a reusable bundle of permissions. You assign roles to people from **Team & Roles**; this page is where you decide what each role may do.

## Before you start

- Anyone whose role can read roles can open the page. To create or change roles, your admin has to give your role permission to write them.
- Every organization starts with Nova's built-in roles: **Admin**, **Dispatcher**, **Technician**, **Bookkeeper** and **Read-only**, plus the Owner role, which only Nova support manages and which this page does not list. They cover most teams; see [[choose-a-built-in-role]]. If one is close but not quite right, start from it.

## Steps

1. In the **Roles** column, press **New role** to start from nothing, or pick a built-in role under **Create from template** to start from a copy of its permissions. The **Create new role** panel opens.
2. Type a **Name** (a short key such as `site-lead`: lowercase letters, numbers, dots, hyphens and underscores) and a **Label** people will read. Add a **Description** so whoever assigns the role knows who it is for.
3. Turn on **Set as default role** only if new members should start with this role when no other role is picked.
4. Open **Permissions** in the panel and choose what the role may do (see step 6), or leave that for later.
5. Press **Create role**. The new role opens under **Role details**.
6. In **Role details**, open a module (for example accounts or quotes) and choose a preset from its list: **None**, **Read-only**, **Standard** or **Full access**. Switch single permissions on or off to fine-tune; the module then shows **Custom**.
7. Use **Search permissions** to find one by name, description or module. **Expand results** opens every matching module at once.
8. Press **Save changes** at the top of **Role details**. The **Unsaved changes** marker disappears once it is stored.

## What you see

- Built-in roles carry a **Template** tag, and the role new members get by default carries a **Default** tag (**Technician** in a new organization). You can change a built-in role's description and permissions, but not its name; clone it to rename it. **Reset to template** puts Nova's permissions back.
- **Deactivate** and **Delete role** appear at the top of **Role details** for roles you created. Deactivating asks for a replacement role for anyone who has it. Deactivated roles sit in a separate list under the active ones, each with **Reactivate**.
- **Role operations** (press **Show actions**) holds **Clone role**, **Export role**, **Import role** and, on a built-in role, **Reset to template**.
- Use **Search roles** to find a role. Drag a role in the list to reorder it.

## If something looks different

- **New role** and the permission switches are greyed out: your role can read roles but not change them.
- Cashier and Store Manager roles also appear when your plan includes Counter Sales (POS).
- Saving refuses because it would remove your own ability to manage roles or users: you are editing a role you hold. Ask another admin.
- A person still cannot reach a page after you changed their role: check whether they have a deny override in [[give-a-user-a-permission-override]], or run [[check-what-a-user-can-access]].

[[route:/settings/org/rbac/roles|Open Roles & Permissions]]