[{"data":1,"prerenderedAt":309},["ShallowReactive",2],{"docs-navigation":3,"docs-page-\u002Fen-gb\u002Farchitecture\u002Froles":105,"docs-surround-\u002Fen-gb\u002Farchitecture\u002Froles":304},[4],{"title":5,"path":6,"stem":7,"children":8,"page":48},"En Gb","\u002Fen-gb","en-gb",[9,53,59,65,79,89,99],{"title":10,"path":11,"stem":12,"children":13},"Architecture","\u002Fen-gb\u002Farchitecture","en-gb\u002Farchitecture\u002Findex",[14,15,19,23,27,31,35,39,49],{"title":10,"path":11,"stem":12},{"title":16,"path":17,"stem":18},"Identity","\u002Fen-gb\u002Farchitecture\u002Fidentity","en-gb\u002Farchitecture\u002F1.identity",{"title":20,"path":21,"stem":22},"Organisations","\u002Fen-gb\u002Farchitecture\u002Forganisations","en-gb\u002Farchitecture\u002F2.organisations",{"title":24,"path":25,"stem":26},"Roles","\u002Fen-gb\u002Farchitecture\u002Froles","en-gb\u002Farchitecture\u002F3.roles",{"title":28,"path":29,"stem":30},"Domains and claims","\u002Fen-gb\u002Farchitecture\u002Fdomains-and-claims","en-gb\u002Farchitecture\u002F4.domains-and-claims",{"title":32,"path":33,"stem":34},"Access","\u002Fen-gb\u002Farchitecture\u002Faccess","en-gb\u002Farchitecture\u002F5.access",{"title":36,"path":37,"stem":38},"Invitations and requests","\u002Fen-gb\u002Farchitecture\u002Finvitations-and-requests","en-gb\u002Farchitecture\u002F6.invitations-and-requests",{"title":40,"path":41,"stem":42,"children":43,"page":48},"Data model","\u002Fen-gb\u002Farchitecture\u002Fdata-model","en-gb\u002Farchitecture\u002F7.data-model",[44],{"title":45,"path":46,"stem":47},"ZoneAudit","\u002Fen-gb\u002Farchitecture\u002Fdata-model\u002Fzoneaudit","en-gb\u002Farchitecture\u002F7.data-model\u002F1.zoneaudit",false,{"title":50,"path":51,"stem":52},"Shared records","\u002Fen-gb\u002Farchitecture\u002Fshared-records","en-gb\u002Farchitecture\u002F8.shared-records",{"title":54,"path":55,"stem":56,"children":57},"Glossary","\u002Fen-gb\u002Fglossary","en-gb\u002Fglossary\u002Findex",[58],{"title":54,"path":55,"stem":56},{"title":60,"path":61,"stem":62,"children":63},"Guides","\u002Fen-gb\u002Fguides","en-gb\u002Fguides\u002Findex",[64],{"title":60,"path":61,"stem":62},{"title":66,"path":67,"stem":68,"children":69},"Products","\u002Fen-gb\u002Fproducts","en-gb\u002Fproducts\u002Findex",[70,71,75],{"title":66,"path":67,"stem":68},{"title":72,"path":73,"stem":74},"Your CobraSphere systems","\u002Fen-gb\u002Fproducts\u002Fyour-systems","en-gb\u002Fproducts\u002F1.your-systems",{"title":76,"path":77,"stem":78},"Enterprise Manager","\u002Fen-gb\u002Fproducts\u002Fenterprise-manager","en-gb\u002Fproducts\u002F2.enterprise-manager",{"title":80,"path":81,"stem":82,"children":83},"Technology","\u002Fen-gb\u002Ftechnology","en-gb\u002Ftechnology\u002Findex",[84,85],{"title":80,"path":81,"stem":82},{"title":86,"path":87,"stem":88},"Why we publish this","\u002Fen-gb\u002Ftechnology\u002Fwhy-we-publish-this","en-gb\u002Ftechnology\u002F1.why-we-publish-this",{"title":90,"path":91,"stem":92,"children":93},"Trust","\u002Fen-gb\u002Ftrust","en-gb\u002Ftrust\u002Findex",[94,95],{"title":90,"path":91,"stem":92},{"title":96,"path":97,"stem":98},"Data governance","\u002Fen-gb\u002Ftrust\u002Fdata-governance","en-gb\u002Ftrust\u002F1.data-governance",{"title":100,"path":101,"stem":102,"children":103},"Updates","\u002Fen-gb\u002Fupdates","en-gb\u002Fupdates\u002Findex",[104],{"title":100,"path":101,"stem":102},{"id":106,"title":24,"body":107,"description":295,"extension":296,"meta":297,"navTitle":298,"navigation":299,"path":25,"roleNote":299,"seo":300,"sitemap":301,"stem":26,"updated":302,"__hash__":303},"docs\u002Fen-gb\u002Farchitecture\u002F3.roles.md",{"type":108,"value":109,"toc":287},"minimark",[110,115,119,125,247,251,254,258,282],[111,112,114],"h2",{"id":113},"the-seven-roles","The seven roles",[116,117,118],"p",{},"A role belongs to one person in one organisation. It is stored as a number, and each role includes every role below it. An Owner can do everything a Billing admin can, a Billing admin everything a Domain manager can, and so on down to Guest viewer.",[120,121,122],"roles-diagram",{},[116,123,124],{},"Each role includes every role below it.",[126,127,128,144],"table",{},[129,130,131],"thead",{},[132,133,134,138,141],"tr",{},[135,136,137],"th",{},"Value",[135,139,140],{},"Role",[135,142,143],{},"What it adds",[145,146,147,163,177,191,205,219,233],"tbody",{},[132,148,149,153,160],{},[150,151,152],"td",{},"1",[150,154,155,159],{},[156,157,158],"code",{},"GUEST_VIEWER"," Guest viewer",[150,161,162],{},"View only, no interactions",[132,164,165,168,174],{},[150,166,167],{},"3",[150,169,170,173],{},[156,171,172],{},"CONTRIBUTOR"," Contributor",[150,175,176],{},"View and contribute",[132,178,179,182,188],{},[150,180,181],{},"7",[150,183,184,187],{},[156,185,186],{},"STANDARD_USER"," Standard user",[150,189,190],{},"View, interact and contribute",[132,192,193,196,202],{},[150,194,195],{},"15",[150,197,198,201],{},[156,199,200],{},"TEAM_MANAGER"," Team manager",[150,203,204],{},"Manage the people in the team and some settings",[132,206,207,210,216],{},[150,208,209],{},"31",[150,211,212,215],{},[156,213,214],{},"DOMAIN_MANAGER"," Domain manager",[150,217,218],{},"Manage the organisation's domains",[132,220,221,224,230],{},[150,222,223],{},"63",[150,225,226,229],{},[156,227,228],{},"BILLING_ADMIN"," Billing admin",[150,231,232],{},"Manage billing and financial settings",[132,234,235,238,244],{},[150,236,237],{},"255",[150,239,240,243],{},[156,241,242],{},"OWNER"," Owner",[150,245,246],{},"Full control",[111,248,250],{"id":249},"why-the-numbers","Why the numbers",[116,252,253],{},"Each value is a set of bits, and each role's bits contain all the bits of the roles below it. A check such as \"is this person at least a Team manager\" passes for a Team manager, a Domain manager, a Billing admin and an Owner.",[111,255,257],{"id":256},"what-the-roles-allow-today","What the roles allow today",[259,260,261,269,279],"ul",{},[262,263,264,268],"li",{},[265,266,267],"strong",{},"Team manager or higher"," can add a person to the organisation, change their role and remove them.",[262,270,271,274,275,278],{},[265,272,273],{},"Domain manager or higher"," can claim domains for the organisation and look after them. See ",[276,277,28],"a",{"href":29},".",[262,280,281],{},"A CobraSphere administrator can do the same for any organisation.",[116,283,284,285,278],{},"Roles say what a person may do inside one organisation. Which products a person may open is a separate question, answered on ",[276,286,32],{"href":33},{"title":288,"searchDepth":289,"depth":289,"links":290},"",3,[291,293,294],{"id":113,"depth":292,"text":114},2,{"id":249,"depth":292,"text":250},{"id":256,"depth":292,"text":257},"Seven roles, from Guest viewer to Owner. Each role includes every role below it.","md",{},null,true,{"title":24,"description":295},{"loc":25},"2026-11-10","iUFAC9NwCJMkFXsqfTGiBhTtBK_-bE3pS0Ebpf-apmg",[305,307],{"title":20,"path":21,"stem":22,"description":306,"children":-1},"A business in CobraSphere, and how people belong to it.",{"title":28,"path":29,"stem":30,"description":308,"children":-1},"How an organisation proves it runs a domain, with one DNS TXT record.",1794661171177]