> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierzero.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

> Role-based access control (RBAC) for TierZero organizations

## Overview

TierZero uses role-based access control (RBAC) to manage what users can access and modify within your organization. Each user is assigned one of three roles that determine their permissions across different features and capabilities.

## Roles

TierZero supports three roles, each with progressively increasing permissions:

<CardGroup cols={3}>
  <Card title="Chat Only" icon="message-circle">
    Can chat with AI and view alert and digest results. Ideal for users who need read-only access to AI-generated insights.
  </Card>

  <Card title="Member" icon="users">
    Can chat with AI and manage all operational resources like knowledge, alert agents, and digests.
  </Card>

  <Card title="Admin" icon="shield">
    Full administrative control including integrations, users & roles, usage & billing, and other advanced settings.
  </Card>
</CardGroup>

## Permissions Matrix

The table below shows which capabilities each role has access to across different domains.

| Domain                    |     Admin    |    Member    |   Chat Only  |
| ------------------------- | :----------: | :----------: | :----------: |
| **Chat**                  | Read & Write | Read & Write | Read & Write |
| **Alert Agents**          | Read & Write | Read & Write |   Read Only  |
| **Support Agents**        | Read & Write | Read & Write |   Read Only  |
| **Digest Agents**         | Read & Write | Read & Write |   Read Only  |
| **Prompt Studio**         | Read & Write | Read & Write |       ✕      |
| **Instructions**          | Read & Write | Read & Write |       ✕      |
| **Skills**                | Read & Write | Read & Write |   Read Only  |
| **Integrations**          | Read & Write |   Read Only  |       ✕      |
| **Users & Roles**         | Read & Write |       ✕      |       ✕      |
| **Usage & Billing**       | Read & Write |       ✕      |       ✕      |
| **Organization API Keys** | Read & Write |       ✕      |       ✕      |

**Read** permissions allow users to view information but not modify it.
**Write** permissions allow users to create, modify, and delete resources within that domain.

## Managing User Roles

Organization admins can manage user roles through the account settings:

1. Click on your **profile picture** in the top right corner
2. Navigate to **Users** under the **Organization** section
3. Find the user you want to update
4. Click on their role dropdown to change it
5. Changes take effect immediately