---
title: Roles & Permissions
description: The roles in DIBFI and exactly what each one can see and do — for direct organizations, assessors, and MSP partners.
navigation:
  icon: i-lucide-users
---

# Roles & Permissions

Everyone in your organization has a **role**, and the role decides what they can see and do. DIBFI keeps roles deliberately simple: a few clear levels that map to how compliance work actually gets divided — admins who run the program, members who do the day-to-day work, and assessors who review it. MSP partners have their own two roles for managing client organizations.

::note
Roles are set when you invite someone and can be changed later. Only an **Organization Admin** (or an MSP admin, for managed clients) can invite people or change roles.
::

## The roles

### Direct organization roles

| Role | Who it's for |
| --- | --- |
| :badge[Organization Admin]{color="info"} | Runs the compliance program — full control of settings, users, billing, and all compliance work |
| :badge[Member]{color="neutral"} | Does the day-to-day work — assessing objectives, uploading evidence, managing risks and tasks |
| :badge[Assessor]{color="warning"} | A reviewer with **read-only** access who can record review notes, but cannot change your data |

### MSP partner roles

| Role | Who it's for |
| --- | --- |
| :badge[MSP Super Admin]{color="info"} | Full control of the MSP account — managed clients, MSP billing, white-label branding, and shared templates |
| :badge[MSP Admin]{color="neutral"} | Manages client compliance work and shared templates, without MSP billing or branding control |

::note
**Platform Admin** is a separate role reserved for DIBFI staff. It is not something you assign inside your organization — see Platform Administration.
::

## What each role can do

The table below shows the main capabilities. "View" access to your compliance data (assessments, evidence, risks, policies, tasks, assets) is available to **every** role, including Assessors.

| Capability | Org Admin | Member | Assessor | MSP Super | MSP Admin |
| --- | :---: | :---: | :---: | :---: | :---: |
| View all compliance data | ✅ | ✅ | ✅ | ✅ | ✅ |
| Manage organization settings | ✅ | — | — | ✅ | — |
| Invite users & change roles | ✅ | — | — | ✅ | — |
| Manage systems & build the SSP | ✅ | — | — | ✅ | ✅ |
| Assess objectives & write narratives | ✅ | ✅ | — | ✅ | ✅ |
| Upload & edit evidence | ✅ | ✅ | — | ✅ | ✅ |
| Delete evidence | ✅ | — | — | ✅ | ✅ |
| Manage evidence requests | ✅ | — | — | ✅ | ✅ |
| Create & manage risks and POA&Ms | ✅ | ✅ | — | ✅ | ✅ |
| Complete compliance-ops tasks | ✅ | ✅ | — | ✅ | ✅ |
| Generate & edit policies | ✅ | ✅ | — | ✅ | ✅ |
| Approve & publish policies | ✅ | — | — | ✅ | ✅ |
| Manage integrations (e.g. Microsoft 365) | ✅ | — | — | ✅ | ✅ |
| Request a readiness review | ✅ | — | — | ✅ | ✅ |
| Write review notes | — | — | ✅ | — | — |
| Access billing | ✅ | — | — | — | — |
| Manage MSP clients & templates | — | — | — | ✅ | ✅ |
| MSP billing & white-label branding | — | — | — | ✅ | — |

::tip
The **Assessor** role is built for an outside reviewer or an internal QA check: they can read everything and leave review notes, but they can't alter a status, upload evidence, or change settings — so your record stays exactly as your team left it.
::

## Managing your team

### Invite a user

::steps{level="4"}

#### Open your user management

As an Organization Admin, go to your users list.

#### Send an invitation

Enter the person's email and choose their **role**. They receive an invitation to join your organization.

#### They accept and sign in

Once they accept, they appear in your team with the role you assigned.

::

::warning
Your plan sets how many users you can have. On the Foundation plan that's a small fixed number; higher plans allow unlimited users. If you're at your limit, you'll need to upgrade before inviting more — see [Billing & Subscriptions](/04-billing-and-msp/billing-and-subscriptions).
::

### Change a role or remove someone

An Organization Admin can change any member's role or remove them at any time from the users list. Removing a person immediately revokes their access; the compliance work they did (evidence, notes, assessments) stays with your organization.

## How it works

### Access is checked everywhere

Your role is enforced consistently across the whole platform — the web app, exports, and the [AI Connector](/05-integrations-and-ai/ai-connector) all honor the same permissions. An assistant connected on your behalf can only ever see what your role allows, and role changes take effect immediately.

### MSP access to managed clients

An MSP's admins act on behalf of the client organizations they manage. They can do compliance work inside a managed client, but each client's data stays isolated to that client — an MSP only reaches the clients it actually manages.

## Related features

:::card-group

::card{title="Organization Settings" icon="i-lucide-settings" to="/00-getting-started/organization-settings"}
Manage your organization's identity and security controls.
::

::card{title="MSP Portal" icon="i-lucide-building-2" to="/04-billing-and-msp/msp-portal"}
Run compliance across multiple client organizations.
::

::card{title="AI Connector" icon="i-lucide-bot" to="/05-integrations-and-ai/ai-connector"}
Read-only AI access that honors these same permissions.
::

:::