> ## Documentation Index > Fetch the complete documentation index at: https://docs.spirii.com/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > Compare the roles and pick the right one for each user you invite to Connect. A role sets what a user can do in Connect: which pages they can open, and which actions they can take on the data their customer scope already gives them access to. ## Overview Every Connect user has a customer and a role. The customer decides *which* data they see; the role decides what they can do with it. Setting one without thinking about the other is how someone ends up able to edit tariffs across an entire portfolio, or unable to see the site they were hired to run. Five roles form a general ladder, from full edit rights down to read-only. Three more are shaped around a specific job and sit outside that ladder. A user can hold more than one role at a time. You assign roles in [Team Access](/capabilities/account/user-management), which also covers who is allowed to assign which role. ## Choosing a role Start from the job, not the role name. | If someone needs to | Give them | | ---------------------------------------------------------------------------------------- | ------------- | | Run the account end to end, including sites, billing, settings, and firmware | Operator | | Work the data day to day — pricing, drivers, tokens — without creating sites or chargers | Editor | | Support drivers: look up sessions, restart a charger, raise a ticket | Supporter | | Maintain pricing only, with no access to drivers or operations | User | | Manage a fleet's drivers, tokens, and charging spend | Fleet Manager | | Run the chargers at one site day to day | Depot Manager | | See everything and change nothing, for reporting or oversight | Viewer | | Commission chargers on site | Installer | ## The general roles Operator, Editor, Supporter, User, and Viewer cover most people you invite. They overlap heavily, so the differences are easier to read as a table than as descriptions. A dash means the role has no access to that area. | Area | Operator | Editor | Supporter | User | Viewer | | ------------------------------------------ | -------------------- | ------------ | ------------ | ------------ | ------ | | Locations | Create, edit, delete | Edit, delete | View | View | View | | Charge boxes and EVSEs | Create, edit, delete | View | View | View | View | | Remote commands | Run | Run | Run | — | — | | Charge box configuration and Plug & Charge | Edit | — | — | — | — | | Scheduled charging | Set | Set | — | — | — | | Power management | Edit | View | — | — | — | | Tariffs | Create, edit | Create, edit | View | Edit | View | | Vouchers | Create, edit | Create, edit | View | Create, edit | View | | Tokens | Create, edit | Edit | View, assign | View | View | | Drivers | Edit, delete | Edit, delete | Edit | — | View | | Sessions and charge detail records (CDRs) | View | View | View | View | View | | SLAs | Create, edit | View | View | — | — | | Operations Center | View | — | — | — | — | | Support tickets | Create, close | Create | Create | Create | View | | Payments and payment terminals | Manage | — | — | — | — | | Settings and branding | Edit | — | — | — | — | | Team Access | Manage users | Manage users | — | View | — | Tokens appear as charge keys in Connect's interface; the two mean the same thing. ### Operator is for your own team Keep Operator for colleagues at your own company, on the operator side of the account. Users scoped to a customer should hold Editor or below, however senior they are on their own side: an Operator can change billing, settings, and pricing everywhere their scope reaches. That makes the Operator and Editor boundary the one worth knowing. Creating locations and charge boxes, charge box configuration, payment terminals, SLAs, settings, branding, and the Operations Center all stay with Operator. An Editor does the rest, including editing and deleting locations. So an Editor who needs a new charger on a site has to ask, which is usually the point: adding a charger changes what that site bills. ## Specialist roles These three exist for one job each. They don't sit above or below the general roles, and they pair well with one — an on-site engineer who also fields driver calls might hold Depot Manager and Supporter together. For a fleet operator managing their own drivers and charging rather than a charging network. * View drivers, tokens, and vouchers * View CDRs for the fleet's charging * View the charge map * Create, edit, and cancel bookings, and view bookable locations Approving and rejecting bookings stays with the Operator. For someone running the chargers at a single site, with no reason to touch pricing, drivers, or the wider network. * View the Connectors page * Run remote commands on the site's charge boxes For an installation partner commissioning hardware, with as little else as possible. * Look up an order and create charge boxes from it * View the locations they work on * Run remote commands and read the OCPP log while testing a unit * Set a temporary EVSE status while a unit is being worked on * View support tickets An Installer creates charge boxes but not locations, so the site has to exist before they arrive. [Installers](/capabilities/automation/installers) covers bringing an installation partner into Connect and how their work fits the commissioning sequence. ## Holding more than one role A user can hold several roles at once, and their access is the sum of them. Pairing Depot Manager with Supporter gives someone the site's chargers plus driver support, without handing over the whole account. Combine roles when no single one fits the job. It's the better answer than moving someone up the ladder to reach a single feature they need. ## Dependencies & limitations * **The roles are fixed.** They're shaped around how charging teams actually divide the work, so the set covers the common shapes without configuration. Where one role doesn't fit a person, combine two. * **Scope data with the customer hierarchy, and features with the role.** A role applies across everything the user can already see, so narrow their reach by placing them under the right customer rather than by picking a smaller role. See [Customers](/components/organisation/customers). * **Role assignment follows the hierarchy.** You can assign any role at or below your own, so an Operator can appoint another Operator and an Editor can build out a team of Editors and below. Covered in [Team Access](/capabilities/account/user-management). ## Related Invite users, scope their data access, and assign roles. The company hierarchy that decides which data a user can reach. Who can charge at a location, as opposed to who can administer it. What an invited user does to set their password and MFA.