Working with Custom Roles and Permissions at GraphCMS
Tags: graphql, headlesscms, permissions, cms
Published: 2020-05-25 11:16:43

---
title: Working with Custom Roles and Permissions at GraphCMS
published: true
description: Control who has access to what with custom roles and permissions.
tags: graphql, headlesscms, permissions, cms
---

At some point you'll want to invite others to contribute, review or manage content, and if you're an agency or large enterprise, you'll want to enable advanced permissions such as schema editing and environments across the development team.

That's why at GraphCMS we have a set of default roles available for you to use, and even the ability to create your own custom roles for ultimate granularity within your use case.

The **default** roles available are;

- **Contributor**: Ability to create and update content.
- **Editor**: Everything Contributor can do **and** delete content.
- **Developer**: Can do everything Editor can, **and** create, update and delete models/enums.
- **Admin**: Can do everything a Developer can, **and** manage teams, create and update projects.
- **Owner**: Can do everything Admin can, **and** change billing and delete projects.

Once you're ready to invite a user, head your project settings and choose "Members" from the sidebar. It's here you can manage your team, custom roles and pending invites.

Let's go ahead and invite someone to our team...

![Invite new user](https://dev-to-uploads.s3.amazonaws.com/i/ays4e66dh1xw7aw1yu4b.png)

All that's needed is an email and a role...

![Invite user dialog](https://dev-to-uploads.s3.amazonaws.com/i/8lyxsr8quj1d94r04vjj.png)

That's it! The invitee will then receive an email with a link to accept the invitation, and if the user is already a GraphCMS user, they will be able to see this project and their own in their project select screen after sign-in.

## Custom roles

But what about custom roles I hear you ask...

Well we've made it just as easy to create a custom role. 

![Custom roles list](https://dev-to-uploads.s3.amazonaws.com/i/efu7w7my87eik45l7j3n.png)

Once you click `+ Create New`, you'll be presented with a form to give the custom role a `Name`, `Description` and permissions picker.

To speed things up, you can copy permissions from another default or custom role, and then fine tune. Otherwise you can go ahead and select the required permissions.

For this example, we'll create a new custom role for `API Access Commander`. The purpose of this role is to only allow users of this role to create, read, update and deleting Permanent Auth Tokens, as well as `Read stages` and `Read existing environments`.

![Create a Custom Role dialog](https://dev-to-uploads.s3.amazonaws.com/i/iuaxq4xxx746rm5ebwzq.png)

Now if I go ahead and invite a new user using the `API Access Commander` role, they'll be limited in what they can do once logged in!

![Invite API Access Commander dialog](https://dev-to-uploads.s3.amazonaws.com/i/69791mn61ut15r5549er.png)

📌 Don't forget to add `Read stages` and `Read existing environments` to the accepted permissions.

That's it! When the invited user logs in they'll notice a restricted sidebar.

![GraphCMS sidebar](https://dev-to-uploads.s3.amazonaws.com/i/9puly6zjy8ouyuggjegz.png)