# Roles and permissions (RBAC) > Control which groups of administrators access which console resources and with which operations, and learn the user roles in Ironchip. URL: https://docs.ironchip.com/en/identidad/administracion/permisos/ Ironchip includes a role-based access control system (RBAC). It lets you define which groups of administrators have access to which console resources and with which operations, and it enforces the principle of least privilege within your own IT team. Permission management is a critical part of Ironchip administration, because it controls access to the resources and data of the organization. Assigning permissions to groups and subgroups simplifies administration, because you can grant or revoke access for many users at once. [Download the policies and security (RBAC) documentation as a PDF (in Spanish)](https://7745202.fs1.hubspotusercontent-na1.net/hubfs/7745202/03-politicas-y-seguridad.pdf) ## How RBAC works The permission system is built around three elements: - **Group**: the set of users or administrators the permission applies to (for example, `Ironchip Administrators`, `Presales`, `Mobility`, or `Administration`). - **Resource**: the object or section of the console the permission acts on (for example, Users, Groups, Keys, Applications, Synchronization, RADIUS Servers, or Permissions). - **Operation**: the actions allowed on that resource: All, Read, Write, Update, and Delete. The combination of the three defines a permission rule. Each group can have several rules on different resources, which lets you set up granular administration profiles. In **Security > Permissions** the console shows a table with the columns **Group**, **Resource**, **Operation**, and **Manage**, so you can view and manage all the configured permissions in one place. ## Available operations | Operation | Description | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | **All** | Full access to the resource: it includes all operations (Read, Write, Update, and Delete). It is equivalent to superadministrator rights on that resource. | | **Read** | Read only. The group can view the resource but cannot modify or delete it. | | **Write** | Can create new records in the resource. Cannot modify or delete existing ones. | | **Update** | Can modify existing records. Cannot create new ones or delete. | | **Delete** | Can delete records from the resource. Cannot create or modify. | ## Resources you can manage | Resource | Description | | ------------------------- | --------------------------------------------------------------------------------------- | | **Users (All)** | Full user management: registrations, removals, roles, devices, and account recovery. | | **Groups (Ironchip)** | Management of the user groups of the company in Ironchip. | | **Keys (Ironchip)** | Safe zone management: creation, editing, deletion, and sharing. | | **Keys (Mobility)** | Management of the safe zones of the mobility module. | | **Applications (All)** | Creation and management of the applications integrated into the platform. | | **Synchronization (All)** | Configuration and management of user synchronization (LDAP, SCIM, AD Connect, and CSV). | | **RADIUS Servers (All)** | Management of the RADIUS servers configured on the platform. | | **Permissions (All)** | Management of the RBAC permission system itself. For superadministrators only. | | **All (All)** | Full access to all resources and operations. Equivalent to a global administrator. | ## Create a permission 1. Sign in to the console: [https://app.ironchip.com](https://app.ironchip.com). 2. Go to **Security > Permissions**. 3. Click **Add permission**. The **Add a new permission** window opens. 4. In **Group selection**, choose the group you want to assign the permission to and click **Next**. [Image: Group selection step with the list of company groups] 5. In **Resource selection**, choose in **Select resource type** the resource the permission applies to, for example All, Application Accesses, Applications, Authentication policies, or Billing, and click **Next**. [Image: Resource selection step with the dropdown of resource types] 6. In **Operation selection**, configure the operations according to your needs (Write, Read, Update, Delete, or All). For each one, check **Allow** to permit it or **Deny** to deny it. Click **Next**. [Image: Operation selection step with the Write, Read, Update, Delete, and All operations] 7. In **Permission review**, check the summary, select **I understand the new permission implications and want to continue**, and click **Add**. The permission becomes active immediately. [Image: Permission review step with the summary of the new permission] :::caution[Restrict who manages RBAC] Only groups with **All**, **Write**, or **Update** permission on the **Permissions** resource can manage the RBAC system. We recommend restricting this access to the global administrators group (`Ironchip Administrators`). ::: ## Edit and review permissions The **Permissions** section lists all the permissions, with the assigned resources and the operations accepted for each one. You can delete them, and you can also edit them with the **Edit permission** button. On the right, the details of the selected permissions appear so you can review them quickly. [Image: Permissions section with the permissions table and the Permission details panel on the right] ## Example configuration This table shows the permissions of an example configuration in **Security > Permissions**: | Group | Resource | Operations | | ------------------------- | --------------------- | ------------------------------------------ | | `Ironchip Administrators` | All (All) | All: full access to the platform | | `Presales` | All (All) | All: full access to the platform | | `Mobility` | Keys (Mobility) | All: full management of the mobility zones | | `Administration` | Users (All) | All, Delete, Read, Update, Write | | `Presales` | Groups (Ironchip) | Delete, Read, Update, Write | | `Presales` | Keys (Ironchip) | Delete, Update, Write | | `Presales` | Synchronization (All) | Delete, Update, Write | | `Presales` | RADIUS Servers (All) | Delete | | `Presales` | Permissions (All) | Delete, Update, Write | | `Presales` | Applications (All) | Delete, Write | ## User roles on the platform Independently of the console RBAC, every Ironchip user has one of these three roles: | Role | Description | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Administrator** | Has access to the admin console. Can manage users, applications, accesses, and configuration according to the RBAC permissions assigned to their group. | | **User** | Verified and active user in Ironchip. Has no access to the admin console: can only authenticate in the services they have access to. | | **Guest** | User created on the platform who has not completed verification yet. The shield in the **Protection** column appears orange (invitation sent, not verified) or red (invitation not sent). | To assign the administrator role, see [Assign an administrator](https://docs.ironchip.com/en/identidad/administracion/usuarios-y-grupos/#assign-an-administrator).