---
updatedAt: 2025-11-11T01:46:42.000Z
agentTools:
  projectIndex: https://docs.formant.io/llms.txt
---

# Create a custom role

In addition to the default roles of Viewer, Operator, and Administrator, you can create custom roles with the permissions and access levels you want. Roles can then be quickly assigned to many users via the use of teams.

> 🚧
>
> It is **highly recommended** to start with the settings of a default role and modify its permissions, rather than constructing an entirely new role from scratch.
>
> Setting a resource to **None** may result in error messages that a user does not have access to a particular resource. Required resources may not be immediately obvious; e.g., when administering events, you will also need administration privileges for commands, as an event can be configured to issue a command. After adding your custom configuration, try the expected workflows for your end user and make sure your permissions are set correctly.

This guide will teach you how to create and configure a custom role for your organization.

# Default role permissions

<Table align={["left","left"]}>
  <thead>
    <tr>
      <th>
        Default role
      </th>

      <th>
        Permissions set
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Viewer
      </td>

      <td>
        All permissions set to **View**.  

        * \*Kiosk**set to**None\*\*.
      </td>
    </tr>

    <tr>
      <td>
        Operator
      </td>

      <td>
        All permissions set to **Execute**.\
        All permissions without an **Execute** option set to **View**.  

        * \*Kiosk**set to**None\*\*.
      </td>
    </tr>

    <tr>
      <td>
        Administrator
      </td>

      <td>
        All permissions set to **Administer**.  

        * \*Kiosk**set to**None\*\*.
      </td>
    </tr>
  </tbody>
</Table>

# Step 1: Create a custom role

1. In Formant, in the upper-left corner, open the menu and click **Settings**.
2. Click **Roles**, and then in the upper-right corner, click **Create Role**.
3. Give your new role a name and click **Continue**.

# Step 2: Configure your role

Next, configure your role's permissions:

<Image alt="configuring a custom role" align="center" src="https://files.readme.io/252c7f0-Screenshot_2024-01-24_at_2.21.46_PM.png">
  Configuring a custom role.
</Image>

The following table defines the role's permissions for each permission level.

> 🚧
>
> See the note for **Organization** and **Kiosk**.

<Table align={[null,null,"left",null,null]}>
  <thead>
    <tr>
      <th>
        Resource
      </th>

      <th>
        None
      </th>

      <th>
        View
      </th>

      <th>
        Execute
      </th>

      <th>
        Administer
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Organization
      </td>

      <td>
        No access to this resource.  

        This should almost always be set to at least **View**. A user with no access to the Organization resource will not be able to interact with your Formant organization.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Users
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Devices
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Fleets
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Roles
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Streams
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Views
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Channels
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Comments
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * View
        * Create
        * Edit
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Teleop
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Teleoperate device
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
        * Teleoperate device
      </td>
    </tr>

    <tr>
      <td>
        Terminal
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        Operate device terminal
      </td>

      <td>
        Enable/disable terminal access
      </td>
    </tr>

    <tr>
      <td>
        Port Forwarding
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        Start port forwarding session
      </td>

      <td>
        Enable/disable port forwarding
      </td>
    </tr>

    <tr>
      <td>
        Events
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * View
        * Mark event as read
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
        * Mark event as read
        * To create events, must have Device Administer permission
      </td>
    </tr>

    <tr>
      <td>
        Commands
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * View
        * Run command
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
        * Run command
      </td>
    </tr>

    <tr>
      <td>
        Annotations
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * View
        * Create annotation
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Capture
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        * Create capture link
      </td>

      <td>
        * Create capture link
      </td>
    </tr>

    <tr>
      <td>
        Share
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        * Create share link
      </td>

      <td>
        * Create share link
      </td>
    </tr>

    <tr>
      <td>
        File Storage
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>
        * List, query, or download files
      </td>

      <td>
        * Upload files
        * List, query, or download files
        * Delete files
      </td>
    </tr>

    <tr>
      <td>
        Integrations
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * Export data to S3
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Interventions
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Key Value Storage
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        * Create a new key/value pair
        * Retrieve value for given key
        * Delete value for a key
      </td>

      <td>
        * Create a new key/value pair
        * Retrieve value for given key
        * Delete value for a key
      </td>
    </tr>

    <tr>
      <td>
        Schedules
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        View
      </td>

      <td>
        N/A
      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>

    <tr>
      <td>
        Kiosk
      </td>

      <td>
        No access to this resource.  

        This should almost always be set to **None**.  

        Kiosk mode restricts a user's visibility to a single view. For help setting up Kiosk mode, reach out to our Customer Success team.
      </td>

      <td>
        Forces the user into kiosk mode.
      </td>

      <td>
        N/A
      </td>

      <td>
        Allows the user to administer kiosk mode.
      </td>
    </tr>

    <tr>
      <td>
        Task Summaries
      </td>

      <td>
        No access to this resource.
      </td>

      <td>
        N/A
      </td>

      <td>

      </td>

      <td>
        * View
        * Create
        * Edit
        * Delete
      </td>
    </tr>
  </tbody>
</Table>

When you have your desired set of permissions, continue to Step 3.

# Step 3: Configure access levels

You can restrict the entities to which this role, and therefore any user with this role, has access. To do so, click the **Restrict Access** tab. Assign a set of tags which restricts this role's access to your desired level.

For more information, see [Configure access levels](https://docs.formant.io/docs/getting-started-configure-access-levels).

> 🚧
>
> A role with no tags associated will have unrestricted access to resources within your organization to which it has View access. The permissions will still be set by what you configured in Step 2.

<Callout icon="👋" theme="default">
  ### If you notice an issue with this page or need help, please reach out to us! Use the 'Did this page help you?' buttons below, or get in contact with our Customer Success team via the Intercom messenger in the bottom-right corner of this page, or at [support@formant.io](mailto:support@formant.io).
</Callout>