Roles

Every member of an organization has one role. Each role includes everything the role above it in the table can do.

Role	Can do
User	Upload assessments, run Analyze and Process, ask questions in the Security Center, read the Knowledge Hub and suggest additions.
Reviewer	Everything a user can, plus Review: edit, flag and comment on answers and Send to Finalize. Add or edit Knowledge Hub items (they wait as pending review) and triage the review queue.
Approver	Everything a reviewer can, plus Finalize assessments and approve Knowledge Hub items and conflict decisions.
Admin	Everything, plus Admin: members and invitations, single sign-on and provisioning, integrations, Quick Setup, AI tools (MCP), the audit log and token usage.

Admins change roles in Admin → Users. If your organization uses SCIM or directory sync, roles can come from identity-provider groups instead — see Provisioning.