Creating a Custom Role

When to Use a Custom Role

Custom roles are most useful when none of the eight default roles precisely fits a job function. For example, a Helpdesk Viewer role that can see all certificates and orders but cannot modify anything, or a Billing Auditor role that can access audit logs and financial reports only. Only the Administrator can create, edit, or delete custom roles.

CERTInext now provides starter templates for custom role creation, making it significantly faster to build roles that approximate a standard profile.

Navigating to Custom Roles

Log in as an Administrator, click Settings in the left-hand navigation, then click Users & Roles. Click the Custom Roles tab (the third tab after Users and User Invitations).

Method A: Creating from a Template

On the Custom Roles tab, click + Create Custom Role. In the Creation Method field, select Template. From the Template drop-down, choose the template that most closely matches your requirement. Enter a clear, descriptive Role Name (for example, "Helpdesk Viewer" or "Billing Auditor") and a Description that explains the role's purpose to other Administrators.

Review the pre-selected permissions grouped by module. Check any permission you want to add and uncheck any you want to remove. Pay close attention to scope suffixes - _own, _group, and _all - and choose the minimum scope necessary for the function. Click Save. The new custom role appears in the Custom Roles list.

Starting from a template is the recommended approach. Switch to Method B only when no template is close enough to your requirements.

Method B: Creating from Scratch

On the Custom Roles tab, click + Create Custom Role. In the Creation Method field, select Manual. Enter a Role Name and Description. The full permissions table is displayed with all permissions unchecked. Scroll through and check every permission you need, grouped by module. Apply least-privilege principles throughout: use _own scope unless the role explicitly needs access to other users' records, _group scope when the role needs to oversee a team but not the whole account, and _all scope only for roles that genuinely require account-wide visibility or action capability. Click Save when done.

Assigning a Custom Role to a User

Open the Add User or Edit User form. In the Assign Role section, click the radio button next to Custom Roles. A drop-down lists all available custom roles - select the one you want and click Save.

Editing and Deleting Custom Roles

To edit a custom role, navigate to Settings > Users & Roles > Custom Roles, select the role, and click Edit. Changes take effect immediately for all users assigned that role.

To delete a custom role, navigate to the same path and click Delete. Reassign all users who hold the role before deleting it. Deleting a custom role that is still assigned to active users will cause those users to lose all access until they are reassigned to another role.