---
key: find-the-right-roles-and-permissions-page
title: Find the right page for roles and permissions
audience: staff
section: administration/team-access
routes: ["/settings/org/rbac"]
features: ["settings.org.rbac"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Which Team & Access page to open to give someone a role, change what a role allows, make a one-person exception, or find out why someone is blocked.
keywords: [permissions, roles and permissions, who can do what, access, user access, security, restrict access, permission page]
related: [choose-a-built-in-role, add-a-team-member, change-a-team-members-roles, create-a-role, give-a-user-a-permission-override, check-what-a-user-can-access, require-two-factor-authentication]
---

In the sidebar, open **Administration**. Every page about who can do what is listed under **Team & Access**. The short address `/settings/org/rbac` opens **Roles & Permissions** at `/settings/org/rbac/roles`.

Access in Nova works in layers. A person has one or more roles, each role is a set of permissions, and an override can add or block a single permission for one person. Each layer has its own page.

## Steps

Follow this order when you set up a new team, or jump to the step you need.

1. Read what each built-in role is for in [[choose-a-built-in-role]]. Most teams need nothing else.
2. To change what a role allows, or make a new role, choose **Roles & Permissions**. See [[create-a-role]].
3. To add a person or change their roles, choose **Team & Roles**. The page heading reads **Organization Users**. See [[add-a-team-member]] and [[change-a-team-members-roles]].
4. When one person needs a permission their role does not give, or must not have one it does, choose **User Overrides**. You can also press **Advanced overrides** in that person's **Edit roles** panel on **Team & Roles**. See [[give-a-user-a-permission-override]].
5. When someone says a button is missing or a page refuses them, choose **Access Checker** and press **Check access**. It names the roles and overrides that decide the answer. See [[check-what-a-user-can-access]].
6. For sign-in rules such as two-step verification, choose **Security Policies**. See [[require-two-factor-authentication]].

## What you see

- On the **Administration** page, **Team & Roles** and **Roles & Permissions** come first under **Team & Access**. **User Overrides** and **Access Checker** are listed after the everyday pages because most organizations rarely need them.
- A page you are not allowed to open is left off the list.

## If something looks different

- The short address shows a page saying you do not have access: it always opens **Roles & Permissions**, which needs permission to read roles. If your role can only manage overrides or check access, choose **User Overrides** or **Access Checker** from **Administration** instead.
- A change to a role does not seem to apply to one person: they may have an override. Run **Access Checker** for that person and permission.

[[route:/settings/org/rbac/roles|Open Roles & Permissions]]