> For the complete documentation index, see [llms.txt](https://docs.certinext.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.certinext.io/documentation/user-roles-and-access-control/role-based-access-control/creating-a-custom-role.md).
# Creating a Custom Role
#### When to Use a Custom Role
Custom roles are most useful when none of the eight default roles precisely fits a job function. For example, a Helpdesk Viewer role that can see all certificates and orders but cannot modify anything, or a Billing Auditor role that can access audit logs and financial reports only. Only the Administrator can create, edit, or delete custom roles.
CERTInext now provides starter templates for custom role creation, making it significantly faster to build roles that approximate a standard profile.
#### Navigating to Custom Roles
*Log in as an Administrator, click Settings in the left-hand navigation, then click Users & Roles. Click the **Custom Roles** tab (the third tab after Users and User Invitations).*
#### Method A: Creating from a Template
*On the Custom Roles tab, click **+ Create Custom Role**. In the Creation Method field, select Template. From the Template drop-down, choose the template that most closely matches your requirement. Enter a clear, descriptive Role Name (for example, "Helpdesk Viewer" or "Billing Auditor") and a Description that explains the role's purpose to other Administrators.*
Review the pre-selected permissions grouped by module. Check any permission you want to add and uncheck any you want to remove. Pay close attention to scope suffixes - `_own`, `_group`, and `_all` - and choose the minimum scope necessary for the function. Click Save. The new custom role appears in the Custom Roles list.
Starting from a template is the recommended approach. Switch to Method B only when no template is close enough to your requirements.
#### Method B: Creating from Scratch
On the Custom Roles tab, click **+ Create Custom Role**. In the Creation Method field, select Manual. Enter a Role Name and Description. The full permissions table is displayed with all permissions unchecked. Scroll through and check every permission you need, grouped by module. Apply least-privilege principles throughout: use `_own` scope unless the role explicitly needs access to other users' records, `_group` scope when the role needs to oversee a team but not the whole account, and `_all` scope only for roles that genuinely require account-wide visibility or action capability. Click Save when done.
#### Assigning a Custom Role to a User
Open the Add User or Edit User form. In the Assign Role section, click the radio button next to Custom Roles. A drop-down lists all available custom roles - select the one you want and click Save.
#### Editing and Deleting Custom Roles
To edit a custom role, navigate to Settings > Users & Roles > Custom Roles, select the role, and click Edit. Changes take effect immediately for all users assigned that role.
To delete a custom role, navigate to the same path and click Delete. Reassign all users who hold the role before deleting it. Deleting a custom role that is still assigned to active users will cause those users to lose all access until they are reassigned to another role.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.certinext.io/documentation/user-roles-and-access-control/role-based-access-control/creating-a-custom-role.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.