# Custom Roles & Permissions {#custom-roles--permissions}


Define custom roles with granular permission control.


## Default Roles {#default-roles}


| Role        | Access Level             |
| ----------- | ------------------------ |
| SUPER_ADMIN | Full system access       |
| ADMIN       | Organization management  |
| MANAGER     | Team management          |
| EMPLOYEE    | Self-service access      |
| CANDIDATE   | Limited application view |
| VIEWER      | Read-only access         |


## Creating Custom Roles {#creating-custom-roles}


1. Go to **Settings** → **Roles & Permissions**
2. Click **Add Role**
3. Enter role name
4. Select permissions from categories


## Permission Categories {#permission-categories}


| Category      | Examples                         |
| ------------- | -------------------------------- |
| Organization  | View org, edit org, manage teams |
| Employee      | View employees, edit, delete     |
| Time Tracking | View time, approve timesheets    |
| Projects      | Create, edit, delete projects    |
| Tasks         | Create, assign, manage status    |
| Financial     | View invoices, create, approve   |
| Reports       | View reports, export data        |
| Admin         | Manage roles, integrations       |


## Permission Enforcement {#permission-enforcement}


Permissions are enforced at multiple layers:





```mermaid
graph LR
    Request --> Guard[Permission Guard]
    Guard -->|Check| RoleService
    RoleService --> DB[(Role-Permission Table)]
    Guard -->|Allowed| Controller
    Guard -->|Denied| 403[403 Forbidden]
```






### Guard-Based {#guard-based}


```typescript
@UseGuards(PermissionGuard)
@Permissions(PermissionsEnum.ORG_EMPLOYEES_EDIT)
@Put(':id')
async update(@Param('id') id: string, @Body() dto: UpdateDTO) {
  return this.service.update(id, dto);
}
```


## API {#api}


```
GET /api/role
POST /api/role
GET /api/role/:id/permissions
PUT /api/role/:id/permissions
```


## Related Pages {#related-pages}


- [Guard System](https://sourcey-gauzy.pages.dev/architecture/guard-system/index.md) — guards
- [Tenant Isolation](https://sourcey-gauzy.pages.dev/security/tenant-isolation/index.md) — tenant security
- [Organization Settings](https://sourcey-gauzy.pages.dev/admin/organization-setup/index.md) — org config