Roles — overview

What you'll learn#

• What a Role is in VAT Portal
• How Role differs from the access levels explained in the previous article
• Where Role appears in the UI
• Why you can't create new roles yourself

What a Role is#

A Role is a named preset that an admin picks when creating or editing a user. Each role bundles a few things:

• An access level (one of the seven from Access levels explained).
• A user-friendly name (e.g., "Operator", "AppAdmin", "Manager").
• Sometimes a scope — a specific module or resource the role is associated with.

Think of a role as a shortcut label that says "this kind of user gets this access level". Instead of setting raw numbers on every user, admins pick a role from a list, and the role determines the user's default access level across the system.

Role vs. access level#

Roles and access levels are related but not the same thing:

So every role points to a single access level, but the role's name is what you see in the UI — and that's what makes the system approachable. Instead of asking "what access level should this user be?" (and facing the counter-intuitive "lower is more" numbers), you ask "what role is this person?" and pick AppAdmin, Operator, or whatever matches.

Where Role appears#

On the Users page (Settings → Users)

• Each user's row shows their Role as a small badge.

When creating or editing a user

• The User dialog has a Role dropdown. Picking a role sets the user's default access level for the system.
• The role dropdown lists every role defined in your system's catalog. You pick one; you don't type it freely.

On the user's own Profile page (Header → user icon → Profile)

• The Role line in the Account Information card shows the role name the admin chose for that user.

See Creating a new user and Editing a user's profile for the full context.

Role vs. per-resource access#

Role sets the default; per-resource access overrides it.

Every user's role acts as their baseline access level across all resources they're permitted to see. But for specific resources, that default can be overridden:

• A user whose role is Operator might be explicitly granted AppAdmin on the document resource — giving them the ability to create and manage documents, while staying at Operator everywhere else.
• A user whose role is AppAdmin might be explicitly dropped to ReadOnly on user — they can still admin Document Flow, but can't see other people's accounts.

The per-resource overrides are set in the Manage Access dialog, covered in Managing a user's access (per-company ACLs). The role is what you pick once, at account creation; the overrides are for the exceptions.

You don't create or edit roles yourself#

There is no "Roles" page in VAT Portal's admin interface — roles are set up in the system catalog at deployment. The list of roles available to you when you create a user is whatever your VAT Portal instance was configured with.

If you need a new role that doesn't exist — say, a specialized level for a new team's needs — contact your VAT Portal implementation partner or system administrator. For most organizations, the default set of roles covers every realistic user type.

In practice: think of roles as fixed options, like blood types. You pick from them; you don't invent your own.

Common questions#