> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and tenant access

> Manage team members' roles and tenant access in the Authsignal Portal.

Roles control what team members can view and change in the Authsignal Portal. Tenant access controls which tenants they can access.

## Available roles

| Role                | Permissions                                                                                    |
| ------------------- | ---------------------------------------------------------------------------------------------- |
| **Admin**           | Full administrative privileges, including tenant and organization management.                  |
| **Support Analyst** | Read access to actions and users, plus permission to manage authenticators on behalf of users. |
| **Read Only**       | Read-only access. Cannot make changes.                                                         |

Choose the role that matches the team member's responsibilities. For example, use **Support Analyst** for a support agent who needs to investigate user activity and [reset authenticators](/knowledge-base/administration/resetting-user-authenticators).

## Organization and tenant roles

Each team member has an **Organization role**. By default, they inherit this role in the tenants they have access to.

<Frame caption="E2E Tests and Demo both tenants inherit the team member's Support Analyst organization role.">
  <img src="https://mintcdn.com/authsignal-23/bTGiWtFkXMOwJ6P4/images/docs/knowledge-base/roles/tenant-access-roles.png?fit=max&auto=format&n=bTGiWtFkXMOwJ6P4&q=85&s=847c4f5ad7aa0b9d4ee1d1fef2cd4457" alt="Access and roles panel with Support Analyst selected as the organization role and E2E Tests and Demo selected with Inherit." width="2130" height="1202" data-path="images/docs/knowledge-base/roles/tenant-access-roles.png" />
</Frame>

You can override the role for an individual tenant. Under **Tenant access and roles**, select a tenant and choose its **Tenant role**:

* **Inherit** uses the team member's organization role.
* A specific role overrides the inherited role for that tenant.

For example, a team member with the **Admin** organization role can have a **Support Analyst** override for **Passkey playground**.

<Frame caption="Demo has Admin assigned explicitly, while Passkey playground has a Support Analyst override.">
  <img src="https://mintcdn.com/authsignal-23/bTGiWtFkXMOwJ6P4/images/docs/knowledge-base/roles/inherit-access.png?fit=max&auto=format&n=bTGiWtFkXMOwJ6P4&q=85&s=1bfe22069e44c89191250e1324183bff" alt="Access and roles panel with Admin selected as the organization role, Demo set to Admin, Passkey playground set to Support Analyst, and E2E Tests and SDK Tests unchecked." width="2220" height="1456" data-path="images/docs/knowledge-base/roles/inherit-access.png" />
</Frame>

## Add a team member

Sign in as an organization **Admin**. Open the user menu in the top right to find **Organization settings**.

1. Open [**Organization settings > Team**](https://portal.authsignal.com/organisations/team).
2. Click **Add team member**.
3. Enter their **Name** and **Email**.
4. Choose an **Organization role**.
5. Under **Tenant access**, select the tenants they need.
6. Click **Add team member** to send the invitation.

To set a tenant-specific role after adding the member, open their name in the team list and follow the steps below.

## Change roles or tenant access

Sign in as an organization **Admin** to update a team member's access.

1. Open **Organization settings > Team** and select the team member's name.
2. Under **Access and roles**, update their **Organization role** if needed.
3. Under **Tenant access and roles**, select or clear tenants to update their access.
4. For each selected tenant, leave **Tenant role** set to **Inherit** or choose a specific role.
5. Click **Save changes**.

Changing an organization role also changes the inherited role for tenants set to **Inherit**. Choose **Inherit** again to remove a tenant-specific override.