---
title: Roles: Overview
slug: rbvm-help/roles-overview
createdAt: 2026-10-26T13:51:21.750Z
---

**Summary**: High-level overview of the different roles in RiskSense, including foundational, supplemental, and custom roles.

**Role-based access control (RBAC)** uses **privileges** (an action or set of actions available in the platform, **represented by the cards** on the **Roles** page) and associates one or more of these privileges to a **role**. You then **assign users one or more roles** based on their job and scope of work.

A **role** is a configuration of **Allowed**, **Not Allowed**, and **Not Configured** for each system privilege. Each privilege must be set to one of these three values for each role.

There are two types of RiskSense-provided roles: **foundational **and **supplemental**.

### Foundational Roles

**Foundational roles** are a set of uneditable, predefined roles designed to provide a persona set that can use the platform differently. Use these foundational roles to give users the full RiskSense platform experience in their own intended ways.

- **Administrator**: This user has all possible privileges that exist for a user. This role is for RiskSense account administrators. We recommend only giving this role to a minimal number of users.
- **Basic User**: This user can use the platform's core functionality for platform access to findings and assets.
- **C Level Observer**: This user can view, save, and share dashboards and filters. Other actions are denied.
- **Data Manager**: This user can manage integrations, uploads, and groups in addition to other important platform data.
- **Disabled**: Disables user's account access to RiskSense.
- **Read Only**: This user can only view platform data. Other actions are denied.
- **Security Analyst**: This user can approve false positive and severity update workflows. They can also manually upload data to the platform.
- **Vulnerability Manager**: This user can manage findings, assignments, and remediation projects for your teams.

### Supplemental Roles

**Supplemental roles** are a set of predefined roles designed to provide a specific job function to our customers that can be used in conjunction with other roles to bestow more user privileges without promoting the user to a higher foundational role and giving them additional privileges they should not have.

- **Asset Owner**: Can manage assets and change an asset's group/network.
- **Automation Owner**: Can use the automation module to view, create, and enable/disable playbooks.
- **Automation SLA Owner**: Can use the automation SLA module to create, edit, and enable/disable SLAs.
- **Client Settings Owner**: Can access and modify client-level settings.
- **Findings Assignment Owner**: Can assign/unassign findings to/from other users.
- **Global Workflow Owner**: Can perform all actions on all workflow types and modify other user's workflows.
- **Group Owner**: Can manage user groups and user group membership.
- **Integration Owner**: Can manage networks, scanners, integrations, and uploads.
- **Manual Upload Owner**: Can manage networks, scanners, uploads, and assessments.
- **Risk Owner**: Can perform all actions on risk acceptance and severity update workflows and modify these workflow types for other users.
- **SLA Owner**: Can create, modify, and delete SLAs.
- **Tag Owner**: Can fully use the Tags feature and overwrite tag ownership.
- **User & Role Provisioning Owner**: Can use the Identity and Access Management (IAM) module's Users & Roles pages to create, assign, and remove users and roles.