Skip to main content
Roles control what each person can see and do in Cortex, from viewing catalogs to editing Scorecards, configuring integrations, and creating API keys. Every user has at least one role, and you can also assign roles to teams. If a user doesn’t have permission to do something, Cortex hides that option from them. Cortex comes with four default roles. When you need something more specific, such as a role that can manage Scorecards but not settings, you can create a custom role.

​
How roles work

  • Every user has at least one role. New users get your workspace’s default role when they first log in.
  • Roles can come from a user or a team. When you assign a role to a team, every member of that team gets that role’s permissions, including people who join the team later.
  • Permissions combine across roles. When someone has more than one role, they get every permission from all of their roles. For example, a user with the Manager role who belongs to a team with the Admin role has Admin permissions everywhere in Cortex.
  • Roles also apply to API keys. You can assign a default or custom role to an API key to limit what it can do. Personal access tokens always have the same permissions as the user who created them.

​
Default roles

Every workspace includes the four roles below. Each role includes everything in the role before it, plus more. You can’t edit the default roles, but you can create a custom role with any combination of permissions. For the full list of permissions and which default role includes each one, see the Permissions reference.

​
Custom roles

Custom roles let you grant exactly the permissions a group of people needs. For example, you might create a role for Scorecard owners that adds Edit Scorecards without giving full Manager access, or a temporary role that you remove once someone finishes a task. Learn more in Custom roles.

​
Where to manage roles

Users with the View Roles permission can view the Permissions page. To make changes, users need the Configure Roles permission. Both are included in the Admin role by default. To access the Permissions page:
  1. From the main sidebar, click your avatar in the bottom-left corner.
  2. Select Settings.
  3. From the Settings menu, locate the Security and access section, then click Permissions.
    The Permissions page in Cortex.
The page has two tabs:
  • Permissions - View users and teams, assign and remove roles, and set the default role for new users.
  • Roles - View, create, edit, and delete custom roles.

​
Other ways to control access

Roles are the main way to control access in Cortex, but a few features add their own controls on top of them:
  • Workflows - Limit who can run a Workflow to specific users, teams, or roles, or require the user to be an owner or editor of the entity. See Configuring Workflow settings.
  • Team ownership entity editing - Limit entity editing to the teams that own each entity. See Team ownership entity editing.
Last modified on November 9, 2026