# Roles

**Roles** under **Users & Access** are named permission sets you assign to users, the way to give staff scoped access without handing out the full **Admin** flag. A role bundles two lists:

- **Admin Permissions** control which admin-area actions its holders can perform, like `servers.read` or `nodes.create`.
- **Server Permissions** are the same keys [subusers](/docs/panel/features/server/subusers) use, granted on every server the holder can open, on top of whatever they already have as owner or subuser. Combined with the `servers.read` admin permission, that effectively applies them panel-wide.

Every key is documented in the [Permissions Reference](/docs/panel/features/dashboard/permissions). Root admins bypass roles entirely; a role only matters for accounts without the **Admin** toggle. Users get a role on their [admin user page](/docs/panel/features/admin/users), or automatically through [OAuth provider mappings](/docs/panel/features/admin/oauth-providers#mappings).

The list shows each role's ID, Name, Server Permissions and Admin Permissions (as counts), and Created date. **Create** requires `roles.create`.

![](/docs/panel/features/admin/images/roles/list.webp)

## Creating and Editing a Role

The form is the same for creating and updating:

| Field | Notes |
| --- | --- |
| **Name** | Required. |
| **Description** | Optional. |
| **Require Two Factor** | "Require users with this role to use two factor authentication." Enforced hard: holders without 2FA are blocked from everything except setting up 2FA on their [Account page](/docs/panel/features/dashboard/account) and logging out. |

![](/docs/panel/features/admin/images/roles/create-form.webp)

Below that sit the two permission pickers, **Server Permissions** and **Admin Permissions**: expandable categories where you tick individual permissions or toggle a whole category at once, with copy and paste for moving a selection between roles. It's the same picker used when scoping [API keys](/docs/panel/features/dashboard/api-keys).

![Role form with permission pickers](/docs/panel/features/admin/images/roles/general.webp)

Finish with **Save** (or **Save & Stay** when creating). An existing role also offers **Duplicate** (requires `roles.create`; asks for a new name, prefilled with "(copy)") and **Delete** (requires `roles.delete`, with a confirmation).

::: warning
Selecting `users.impersonate` shows a warning for good reason: it lets holders of this role impersonate other users. Be cautious assigning it to roles with less trusted users, see [Impersonation](/docs/panel/features/admin/users#impersonation) for the exact rules.

![](/docs/panel/features/admin/images/roles/impersonate-warning.webp)

:::

## Users Tab

A role's view has a **Users** tab (requires `users.read`) listing every user currently holding the role, with the same columns as the [Users](/docs/panel/features/admin/users) list. Role-based admins get the same crown marker there as root admins.

![](/docs/panel/features/admin/images/roles/users.webp)