Console roles and permissions

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/reference/09_security/01_console-roles.md)

## Organization roles[​](#organization-roles "Direct link to Organization roles")

Refer to [Manage cloud users](/docs/cloud/security/manage-cloud-users) for instructions on assigning organization roles.

ClickHouse has four organization level roles available for user management. Only the admin role has default access to services. All other roles must be combined with service level roles to interact with services.

|  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Role Description|  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | Admin Perform all administrative activities for an organization and control all settings. This role is assigned to the first user in the organization by default and automatically has Service Admin permissions on all services.|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | Billing View usage and invoices, and manage payment methods.|  |  |  |  | | --- | --- | --- | --- | | Org API reader API permissions to manage organization level settings and users, no service access.|  |  | | --- | --- | | Member Sign-in only with the ability to manage personal profile settings. Assigned to SAML SSO users by default. | | | | | | | | | |

## Service roles[​](#service-roles "Direct link to Service roles")

Refer to [Manage cloud users](/docs/cloud/security/manage-cloud-users) for instructions on assigning service roles.

Service permissions must be explicitly granted by an admin to users with roles other than the admin role. The service admin role is pre-configured with SQL console admin access, but may be modified to reduce or remove permissions.

|  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Role Description|  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Service reader View services and settings.|  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | Service admin Manage service settings.|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | Service API reader API permissions to read service settings for all services.|  |  |  |  | | --- | --- | --- | --- | | Service API admin API permissions to manage service settings for all services.|  |  | | --- | --- | | Basic service API reader API permissions to use query API endpoints. | | | | | | | | | | | |

## SQL console roles[​](#sql-console-roles "Direct link to SQL console roles")

Refer to [Manage SQL console role assignments](/docs/cloud/guides/sql-console/manage-sql-console-role-assignments) for instructions on assigning SQL console roles.

|  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| Role Description|  |  |  |  | | --- | --- | --- | --- | | SQL console read only Read only access to databases within the service.|  |  | | --- | --- | | SQL console admin Administrative access to databases within the service equivalent to the Default database role. | | | | | |

## Console Permissions[​](#console-permissions "Direct link to Console Permissions")

The table below describes the ClickHouse console and SQL console permissions. More information is linked in the header for each category.