> For the complete documentation index, see [llms.txt](https://docs.gataca.io/developers/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gataca.io/developers/platform-tutorials/self-sovereign-identity/settings/studio-roles.md).

# Studio Roles

This document describes all the default roles you can select in Gataca Studio.

Gataca uses a **scope-based strategy** to manage roles and permissions. This means access to features in Studio is determined by the scopes assigned to a role, rather than the features being tied to specific roles.

By using scopes, you can precisely manage access and permissions, ensuring that each role has the appropriate level of access to Studio's features based on organizational needs.

**Default Roles:**

* The scopes assigned to default roles are aligned with their descriptions, ensuring consistency and clarity in what each role can access.

**Custom Roles:**

* When creating custom roles, you have the flexibility to tailor the roles to match your organization’s hierarchy and specific responsibilities.

{% hint style="danger" %}
Keep in mind that custom roles may not automatically align with predefined scopes, so you should carefully configure scopes to match the role’s intended access and functionality.
{% endhint %}

## Roles <a href="#roles" id="roles"></a>

| Role                   | Description                                                                                                                                                                                                                                            | Scopes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Provider Admin**     | <p>This role manages a provider organization.</p><p></p><p>This kind of organization can manage its own platform, handling its clients and the organization stored there.</p><p></p><p><strong>This role is accessible just to providers.</strong></p> | `DeleteProviders`, `UpdateProviders`, `ReadProviders`, `CreateTenants`, `DeleteTenants`, `UpdateTenants`, `ReadTenants`, `CreateRoles`, `DeleteRoles`, `UpdateRoles`, `ReadRoles`, `CreateUsers`, `DeleteUsers`, `UpdateUsers`, `ReadUsers`, `CreateDids`, `DeleteDids`, `UpdateDids`, `RequestCatalogModifications`, `ReadDids`, `CreateSSIConfigs`, `DeleteSSIConfigs`, `UpdateSSIConfigs`, `ReadSSIConfigs`, `CreateApiKeys`, `DeleteApiKeys`, `UpdateApiKeys`, `ReadApiKeys`                                                                                                                      |
| **Organization Owner** | <p>This role manages a specific organization.</p><p>It has all the permissions needed to manage all the features attached to an organization, plus access to the billing and subscription section.</p>                                                 | `DeleteTenants`, `UpdateTenants`, `ReadTenants`, `CreateRoles`, `DeleteRoles`, `UpdateRoles`, `ReadRoles`, `CreateUsers`, `DeleteUsers`, `UpdateUsers`, `ReadUsers`, `CreateDids`, `DeleteDids`, `UpdateDids`, `RequestCatalogModifications`, `ReadDids`, `CreateSSIConfigs`, `DeleteSSIConfigs`, `UpdateSSIConfigs`, `ReadSSIConfigs`, `CreateApiKeys`, `DeleteApiKeys`, `UpdateApiKeys`, `ReadApiKeys`, `readSessions`, `validateSessions`, `issuanceProcesses`, `deleteSessions`, `readDataAgreements`, `updateDataAgreements`, `revokeDataAgreements`, `manageCredentials`, `manageSubscriptions` |
| **Tenant Admin**       | <p>This role manages all the technical features in an organization.</p><p></p><p>This role has been created for the person in charge of the organization's technical area.</p>                                                                         | `UpdateTenants`, `ReadTenants`, `CreateRoles`, `DeleteRoles`, `UpdateRoles`, `ReadRoles`, `CreateUsers`, `DeleteUsers`, `UpdateUsers`, `ReadUsers`, `CreateDids`, `DeleteDids`, `UpdateDids`, `RequestCatalogModifications`, `ReadDids`, `CreateSSIConfigs`, `DeleteSSIConfigs`, `UpdateSSIConfigs`, `ReadSSIConfigs`, `CreateApiKeys`, `DeleteApiKeys`, `UpdateApiKeys`, `ReadApiKeys`                                                                                                                                                                                                               |
| **DID Owner**          | This role manages a specific DID in the organization. Depending on the organization's hierarchy, it could be used to split responsibilities between departments, companies, etc.                                                                       | `DeleteDids`, `UpdateDids`, `RequestCatalogModifications`, `ReadDids`, `CreateSSIConfigs`, `DeleteSSIConfigs`, `UpdateSSIConfigs`, `ReadSSIConfigs`, `CreateApiKeys`, `DeleteApiKeys`, `UpdateApiKeys`, `ReadApiKeys`                                                                                                                                                                                                                                                                                                                                                                                 |
| **SSI Config Manager** | This role can manage SSI Configs attached to a particular logical area (Tenants, DIDs, SSI Configs..). Depending on the organization's hierarchy, it could be used to split responsibilities between departments, companies, etc.                      | `CreateSSIConfigs`, `ReadSSIConfigs`, `UpdateSSIConfigs`, `DeleteSSIConfigs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **API Key Manager**    | This role can manage API Keys attached to a concrete logical area (Tenants, DIDs, SSI Configs, API Keys..). Depending on the organization's hierarchy, it could split responsibilities between departments, companies, etc                             | `CreateApiKeys`, `ReadApiKeys`, `UpdateApiKeys`, `DeleteApiKeys`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| **Operator**           | This role can manage sessions attached to a concrete logical area (Tenants, DIDs, SSI Configs..). Depending on the organization's hierarchy, it could be used to split responsibilities between departments, companies, etc.                           | `readSessions`, `validateSessions`, `issuanceProcesses`, `deleteSessions`, `readDataAgreements`, `updateDataAgreements`, `revokeDataAgreements`, `manageCredentials`                                                                                                                                                                                                                                                                                                                                                                                                                                  |

## Scopes <a href="#scopes" id="scopes"></a>

<table><thead><tr><th width="365">Scope</th><th>Description</th></tr></thead><tbody><tr><td>readProviders</td><td>It allows the user to read all the providers on the platform.</td></tr><tr><td>updateProviders</td><td>It allows the user to update the providers to it has permission.</td></tr><tr><td>deleteProviders</td><td>It allows the user to delete the providers to it has permission.</td></tr><tr><td>createTenants</td><td>It allows the user to create a new organization in the platform.</td></tr><tr><td>readTenants</td><td>It allows the user to read all organizations to it has permission.</td></tr><tr><td>updateTenants</td><td>It allows the user to update all organizations to it has permission.</td></tr><tr><td>deleteTenants</td><td>It allows the user to delete all organizations to which it has permission.</td></tr><tr><td>createRoles</td><td>It allows the user to create new custom roles. The new role created will be accessible in the tenant associated.</td></tr><tr><td>readRoles</td><td>It allows the user to read all the roles in the tenant to which it has permission.</td></tr><tr><td>updateRoles</td><td>It allows the user to update all the roles in the tenant to which it has permission.</td></tr><tr><td>deleteRoles</td><td>It allows the user to delete all the roles in the tenant to which it has permission.</td></tr><tr><td>createUsers</td><td>It allows the user to invite new users to a specific organization.</td></tr><tr><td>readUsers</td><td>It allows the user to read all users of an organization.</td></tr><tr><td>updateUsers</td><td>It allows the user to update all users of a specific organization.</td></tr><tr><td>deleteUsers</td><td>It allows the user to delete all users of a specific organization.</td></tr><tr><td>createDids</td><td>It allows the user to create new DIDs for a specific organization.</td></tr><tr><td>readDids</td><td>It allows the user to read the DIDs of a specific organization.</td></tr><tr><td>updateDids</td><td>It allows the user to update the DIDs of a specific organization.</td></tr><tr><td>deleteDids</td><td>It allows the user to delete the DIDs of a specific organization.</td></tr><tr><td>requestCatalogModifications</td><td>COMING SOON: It has already been developed in the backend but is not visible in the front (This scope is required to create “requests” to Gataca Admins).</td></tr><tr><td>createSSIConfigs</td><td>It allows the user to create issuance and verification templates for a specific organization.</td></tr><tr><td>readSSIConfigs</td><td>It allows the user to read issuance and verification templates of a specific organization.</td></tr><tr><td>updateSSIConfigs</td><td>It allows the user to update issuance and verification templates of a specific organization.</td></tr><tr><td>deleteSSIConfigs</td><td>It allows the user to delete issuance and verification templates of a specific organization.</td></tr><tr><td>createApiKeys</td><td>It allows the user to create API Keys for a specific organization.</td></tr><tr><td>readApiKeys</td><td>It allows the user to read the API Keys of a specific organization.</td></tr><tr><td>updateApiKeys</td><td>It allows the user to update the API Keys of a specific organization.</td></tr><tr><td>deleteApiKeys</td><td>It allows the user to delete API Keys of a specific organization.</td></tr><tr><td>readSessions</td><td>It allows the user to read sessions from issuance or verification requests of a specific organization. Reading all the instances of issuance and verification templates for an organization is possible.</td></tr><tr><td>validateSessions</td><td>It allows the user to validate issuance requests of an organization and fill the information related to that issuance process.</td></tr><tr><td>deleteSessions</td><td>It allows the user to delete sessions from issuance or verification requests of an organization.</td></tr><tr><td>readDataAgreements</td><td>It allows the user to read an organization's data agreements (consents).</td></tr><tr><td>updateDataAgreements</td><td>It allows the user to update a specific organization's data agreements (consents).</td></tr><tr><td>revokeDataAgreements</td><td>It allows the user to revoke a specific organization's data agreements (consents).</td></tr><tr><td>manageCredentials</td><td>It allows the user to change the status of a credential (issued, revoked, suspended).</td></tr><tr><td>manageSubscription</td><td>It allows the user to update the subscription and billing attached to the organization.</td></tr></tbody></table>