> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# About Roles and Permissions

Roles are the foundation of access management in Eon.
Roles are collections of permissions that define what actions a user or API client can take.
Eon uses a role-based access control model to manage access to your account and keep it secure.
Using this model, you'll assign roles to your users and API credentials.

## Permissions

Permissions are the most granular level of access control in Eon.
Each role has a set of permissions that define what actions a user or API credentials are authorized to take.
Because Eon uses role-based access control, you don't assign permissions directly to users or API credentials.
Instead, you'll create roles with the permissions you want, and then assign those roles to users and API credentials.

Each permission grants access to a specific action on your resources, data, or Eon configuration.
Examples of permissions include "View inventory", "Query databases", "Mute and unmute violations", and "Manage API credentials".

All permissions can be set to **Blocked** (no access) or **Allowed** (full access).
Some permissions related to your resources can be further refined using data access control, restricting access to certain resources.

### Data access control

Data access control allows you to set restrictions on the permissions granted by a role.
Using data access control, you can create a block- or allow-list to restrict a permission based on resource properties.
For example:

* You could set **View inventory** to allow access to production resources only.

* You could set **Query databases** and **Download records** to block access to resources with the PII or PHI data classes.

## Roles

As mentioned, roles are collections of permissions you assign to your users and API credentials.
Users can have multiple roles assigned.

API credentials can have only a single role assigned.

### Default roles

Eon comes with five default roles.
Default roles are predefined by Eon and can't be changed.

* **Global admin**: Full admin permissions to the global management console and all resources.

* **Global viewer**: Read access to the global management console and all resources.

* **Admin**: Full admin permissions for resources.

* **Operator**: Read access and ability to back up, query, and restore data for all resources.

* **Viewer**: Read access for all resources.

### Custom roles

In addition to the default roles, you can create custom roles to meet your organization's specific needs.
Custom roles are user-created and can be modified.
See [Manage Custom Roles](/data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles) for more information.

> **Warning**
>
> Global admins can take any action in your Eon account, including creating and removing other global admins.
> Keep your account secure by assigning this role only to the people who really need it.