# Roles and permissions > Create a role, choose what it allows, and give it to members, SCIM groups, and system API keys. Section: Permissions & RBAC Source: https://www.itva.com/docs/permissions-rbac/roles-and-permissions Last updated: 2026-11-03 In this guide, you create a role, choose what it allows, and give it to a member with a set of tags. To learn how roles and tags work together, see [Access control overview](https://www.itva.com/docs/permissions-rbac/access-control-overview). ## Before you begin - You must be an administrator. Only administrators can open **Settings > Users**. - The tags you want to use already exist, and your items have them. See [Use tags](https://www.itva.com/docs/permissions-rbac/use-tags). ## Create a role 1. Select your initials at the top right of the portal, then select **Settings**. 2. Under **Administrator**, select **Users**. 3. Select the **Roles** tab. 4. Select **New Role**. 5. In **Name**, enter a name for the role. For example, "Network operator". 6. In **Description**, enter what the role is for. This field is required. 7. Select **Save**. The page for the new role opens. A new role allows nothing. You choose what it allows in the next section. ## Choose what the role allows The role's page lists each resource in groups: **Core**, **Reporting**, **Inventory**, **Tools**, and **Settings**. Each resource has a **View** column and usually a **Manage** column. Ticketing also has **Create** and **Update**. | Setting | What it does | | --- | --- | | All | Allows the action. For item types that are limited by tags, it applies to items with the tags in the permission. | | User | Ticketing View only. Shows only the tickets where the member is the requestor or a watcher. | | None | Does not allow the action. This is the default. | **Caution: **ITVA saves each change on this page right away. A change applies at once to every member, SCIM group, and API key that has this role. 1. For each resource the role needs, set **View** to **All**. 2. If the role must add, change, or delete that resource, also set **Manage** to **All**. Manage does not include View. A member must be able to view an item before they can open it to change it, so set View as well. Some settings give more than their name says: - **Alerts** View also gives access to the Overview report. - **Scans** View also shows all the applications and certificates that scans found, whatever their tags. ## Give a member permissions A permission is one role plus a set of tags. A member can have more than one permission. 1. In **Settings > Users**, select the **Memberships** tab. 2. Open the member. 3. Select **Manage Permissions**. The **Membership Permissions** panel opens. 4. If the member must have full access, turn on **Administrator** and go to step 8. 5. Under **Permissions**, select **Permission** (the button with a plus icon) to add a row. 6. In the role list, select the role. 7. Select **Tags**. In the **Select Tags** panel, select each tag the role applies to, then select **Select**. To add another role, repeat steps 5 to 7. 8. Select **Save**. You cannot change your own permissions. **Manage Permissions** is not available on your own membership. To give permissions to a new person, select **Invite Member** on the **Memberships** tab. Enter their **Email**, **First Name**, and **Last Name**, then set **Administrator** or **Permissions** in the same way. ## Give permissions through SCIM groups If your identity provider adds people to ITVA through SCIM, you set their permissions on SCIM groups. Each SCIM group has one role and a set of tags. A person in the group gets a permission with that role and those tags. **Caution: **When ITVA syncs a person's SCIM groups, it replaces all of that person's permissions with the permissions from their groups. Changes that you make with **Manage Permissions** are lost at the next sync. 1. In **Settings > Users**, select the **SCIM** tab. 2. Select **New Group**. 3. In **Name**, enter a name for the group. 4. In **External ID**, enter the ID of the group in your identity provider. 5. In **Role**, select the role. 6. In **Tags**, select the tags the role applies to. 7. Select **Save**. To give a group two roles, make two SCIM groups in ITVA, each with its own role. ## Give permissions to a system API key A system API key is for integrations and automation. It has its own permissions, separate from any person. A user API key acts as the person who made it, and has the same access as that person. 1. In **Settings**, under **General**, select **API Keys**. 2. Select **New System API Key**. 3. In **Name**, enter a name for the key. 4. Turn on **Administrator**, or add one or more **Permissions** rows with a role and tags. Give the key only the access the integration needs. 5. Select **Save**. The **API Key Token** dialog opens. 6. Copy the **Token** and keep it in a safe place. You cannot see it again after you close the dialog. 7. Select **Done**. ## Check that it worked 1. In **Settings > Users > Memberships**, find the member. The **Permissions (Group / Role)** column shows **Administrator**, or each role with its tags. 2. Ask the member to sign in and open **Devices**. They see only the devices with their tags, or in folders with their tags. ## Troubleshooting - If a member cannot see an item, make sure the item has one of the tags in their permission. Also make sure that permission's role has View set to All for that resource. - If a member creates an item and then cannot see it, the item has none of their tags. Ask an administrator to add one of the member's tags to the item. - If a member sees subnets, workflows, or dashboards with no matching tags, this is expected. Tags do not limit those resources. Only the role does. - If **Users** is not in **Settings**, you are not an administrator. Ask an administrator to make the change. - If a member's permissions change back after you edit them, the member comes from SCIM. Change the role or tags on their SCIM group instead.