> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vexaris.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> The built in staff roles, what each one can touch, and how custom role permissions work.

**Users → Permissions** decides what each staff role can open and change in the admin panel.

> [!NOTE]
>
> Permission management is available from the Starter plan up. On Free, every staff member is limited to the built in roles as shipped.

## Built in roles

| Role | Can work with |
| - | - |
| Member | Nothing in the panel, this is the customer role |
| Support Team | Dashboard and support tickets |
| Moderator | Dashboard, tickets, licenses and customer management |
| Manager | Store operations: products, categories, orders, marketing, legal and themes, without deep settings |
| Admin | Everything, including payments, integrations and permissions |

## Resource matrix

Permissions are per **resource**, grouped as:

* General: dashboard, users, settings, integrations, modules, statistics, AI assistant
* Store: products, orders, categories, licenses, reviews, coupons, slider, fraud, audit logs
* Marketing: announcements, references, SEO, custom pages, legal, themes
* Support: tickets and ticket categories

Granting a resource grants read and write for that screen. There is no separate "view only" switch per screen, so give a moderator the tickets resource, not the settings resource, when you only need ticket coverage.

## Giving someone staff access

**1. Pick the lightest role**

Support Team covers ticket answering. Reach for Manager or Admin only when the job truly needs it.

**2. Set it on their account**

Users → open the customer → change role.

**3. Confirm**

Have them reload the panel and check the sidebar only shows what you intended.

> [!WARNING]
>
> Payment integrations and API secrets sit under Admin scope. A support hire never needs them, and staff accounts with gateway access are the most expensive kind of mistake.

## Auditing staff

Every panel change by any role lands in the audit log, see [Fraud protection and audit logs](https://docs.vexaris.net/people/fraud-audit.md). If something changed and nobody admits it, the log names the account and the time.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.