> ## Documentation Index > Fetch the complete documentation index at: https://docs.serval.com/llms.txt > Use this file to discover all available pages before exploring further. # Permissions > Understand user roles at the organization and team level in Serval Serval uses a two-level permission system: **organization roles** control what you can do across the entire org, while **team roles** control what you can do within specific teams. ## Organization Roles Every user has one organization-level role that applies across all of Serval. | Role | Description | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Member** | Standard user. Can submit tickets, request access, and use Serval's help desk features. | | **Admin** | Full administrative access. Can manage users, create teams, configure organization settings, and access all teams. | | **Guest** | Limited external user. Typically, a guest is a user who emailed in from a domain that isn't allowlisted. Can only see and interact with the specific tickets they're associated with, and can't browse other tickets, teams, or internal data. | Most users should be **Members**. Reserve **Admin** for IT administrators who need to manage the platform. **Guests** are usually created automatically for external senders from untrusted domains. For more information, see [Email intake](/sections/documentation/helpdesk/email#untrusted-domains). To add a new user, navigate to "Settings" and select "Invite User" --> add their email addresses, choose to make them admin or not and optionally add them to a Serval team *** ## Team Roles Within each team, users are assigned a team-specific role that controls their capabilities for that team. | Role | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Read-Only Agent** | View tickets, journeys, and analytics for the team. Can't make any changes. | | **Agent** | Everything a Read-Only Agent can do, plus respond to and resolve tickets, add internal notes, create saved views, and retry or cancel workflows while handling tickets. | | **Viewer** | Everything an Agent can do, plus view-only access to workflows, skills, knowledge, access policies, rules, campaigns, and databases. | | **Drafter** | Everything a Viewer can do, plus draft (create and edit) workflows and skills. A Drafter can't run, publish, or delete them. | | **Contributor** | Everything a Drafter can do, plus run published workflows, and create and run scheduled Catalyst sessions. Can't publish or delete. | | **Builder** | Everything a Contributor can do, plus create, publish, and delete workflows and skills; run unpublished workflows; install installable workflows; and manage rules, campaigns, knowledge sources, access policies, approval procedures, and databases. | | **Manager** | Everything a Builder can do, plus configure integrations and connected apps, manage team settings, SLAs, schedules, and visibility groups, run access reviews, override approvals, view audit logs, and archive tickets. | A user can be a Manager in one team and an Agent in another. Team roles are independent. The **Drafter** role is being rolled out gradually and may not yet be available in your account. ## Permission Summary ### What Org Guests Can Do * View and reply to the specific tickets they're associated with * Upload attachments to those tickets * No access to other tickets, teams, users, or organization settings ### What Org Members Can Do * Submit tickets through Slack, email, or web portal * Request access to applications * View their own tickets and access requests * Use the catalog to browse access and catalog items ### What Org Admins Can Additionally Do * Create and manage teams * Invite and deactivate users * Configure organization settings (SSO, branding, etc.) * Access all teams regardless of team membership * Manage API keys ### What Team Read-Only Agents Can Do * View all tickets and journeys associated with their team * View team analytics and dashboards * View saved views, workbench threads, and the archive * Can't edit tickets, add notes, or change configuration ### What Team Agents Can Additionally Do * Respond to, update, and resolve tickets * Create internal notes * Create and edit saved views * Retry and cancel workflows while handling tickets * View native knowledge base pages ### What Team Viewers Can Additionally Do * View workflows and skills (read-only) * View knowledge sources, databases, and entities (read-only) * View access policies, approval procedures, rules, and campaigns (read-only) ### What Team Drafters Can Additionally Do * Create and edit workflows and skills (can't run, publish, or delete them) * Create and edit native knowledge base pages and tags (can't delete or archive) ### What Team Contributors Can Additionally Do * Run published workflows * Run workflows on behalf of other team members * Can't publish, delete, or run unpublished workflows * Create, edit, and run scheduled Catalyst sessions ### What Team Builders Can Additionally Do * Create, publish, and delete workflows and skills * Run unpublished workflows * Install and configure installable workflows * Share workflows with other teams * Create and edit rules and [campaigns](/sections/documentation/campaigns/overview) * Edit knowledge sources * Create and edit access policies and approval procedures * Create and edit databases and entities ### What Team Managers Can Additionally Do * Configure integrations and connected apps * Manage team settings * Manage SLAs, schedules, and visibility groups * Run access reviews and override approvals * Manage change models * View audit logs * Archive, trash, and permanently delete tickets ## Managing Permissions ### Changing Organization Roles 1. Go to **Settings** → **People** 2. Find the user and click their name 3. Select **Member**, **Admin**, or **Guest** from the organization role dropdown 4. Save changes ### Changing Team Roles 1. Go to **Settings** → **Teams** 2. Select the team 3. Find the user in the team members list 4. Change their role to **Read-Only Agent**, **Agent**, **Viewer**, **Contributor**, **Builder**, or **Manager** (or **Drafter**, where enabled) 5. Save changes Use your identity provider to automatically assign roles. Map directory groups to Serval roles in **Settings** → **Integrations** → **Directory Sync**. ## Capabilities Toggle Team managers can enable or disable specific Serval products per team using the **capabilities toggle** in team settings. This lets you control which features are available to a team — for example, you can disable Access Management for a team that only handles IT support tickets, or enable Workflows only for teams that need automation. Navigate to **Team Settings** → **Capabilities** to configure which products are active for each team. *** ## Org Admin Quick Join Organization admins can add themselves to any Serval team immediately when clicking a ticket link — without navigating to organization settings first. If an admin clicks a link to a ticket in a team they don't belong to, they can join that team on the spot and access the ticket. *** ## Common Questions Yes. Organization role and team role are separate. An Org Admin could be an Agent on specific teams if they only need to handle tickets, not configure that team. Users without team membership can still submit tickets and request access. They just can't view team visibility groups or use team-specific features. Access approvers are configured per access policy, not by role. Both Agents and Managers can be designated as approvers.