> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/settings-and-security/settings/roles-and-permissions.md). # Roles & Permissions Boza separates workspace administration from responsibility for an individual application. Assign each role for the job it controls. ## Workspace Admin A workspace **Admin** can use the administrative platform, change settings, manage integrations, and run supported workflows. **Settings → General → Members & Roles** lists the users who are currently workspace Admins. The control does not create a new directory user or send a standalone Boza invitation: * **Add Team Members** searches users who already exist in the Boza workspace and promotes the selected people to Admin. * **Remove Member** removes Admin privileges from that person. It does not delete the user from Boza or from the identity provider. {% hint style="warning" %} Workspace administration is broad access. Promote only people who need to operate Boza, and keep at least two trusted Admins so the workspace does not depend on one account. {% endhint %} ### Promote an Existing User 1. Open **Settings → General**. 2. Under **Members & Roles**, click **Add** (+). 3. Search by name or email. 4. Select one or more existing users. 5. Keep the visible role set to **Admin**. 6. Click **Add Member** or **Add Members**. The selected users appear in the Admin list after the update succeeds. ### Remove Admin Privileges 1. Open **Settings → General → Members & Roles**. 2. Find the Admin. 3. Click **Remove Member** (trash icon). 4. Confirm the change. The person remains in the workspace user directory. Review their application roles separately. ## Application Ownership Roles Application roles are assigned from an application's **App Owners** card. They describe responsibility for that application and do not make someone a workspace Admin. | Role | Responsibility | Assignment rule | | ------------------- | --------------------------------------------------- | --------------------------- | | **Super Admin** | Primary accountability and access-grant work | At most one per application | | **Budget Owner** | Cost, subscription, budget, and renewal decisions | One or more | | **Admin** | Additional operational administration | One or more | | **Access Reviewer** | Confirms the application in Access Review campaigns | One or more | A person can hold several application roles at the same time, except **Super Admin** and **Admin** cannot be combined. Assigning a new Super Admin replaces the previous Super Admin role while preserving that person's other eligible roles. ### Assign Application Roles 1. Open **Applications** and select an application. 2. On **Overview**, find **App Owners**. 3. Click **Edit Owners**. 4. Add a user or update the roles beside an existing owner. 5. Save the assignments. See the [App Detail Page](/docs/inventory/applications/app-detail.md#owners-and-roles). ## Access Reviewer Experience An Access Reviewer receives only the review records assigned to them for approved applications. A reviewer who is not also a workspace Admin uses **My reviews** to complete those certifications and does not gain campaign-configuration access. {% hint style="warning" %} Boza AI is a current exception to this role scope. Any authenticated platform user who can open the assistant—including a reviewer-only user—can ask questions across the organization's Boza data. Application roles and reviewer assignments do not filter AI results. {% endhint %} Assign reviewers before launching a campaign because a running campaign keeps the owner snapshot captured at launch. See [Access Reviews](/docs/user-management/access-reviews.md). ## Roles That Do Not Grant Workspace Administration * A **Team Lead** organizes a team on the Organization page. * A user synchronized from an identity provider is not automatically a workspace Admin. * A license assignment gives access to the tracked application, not to Boza administration. * An application Super Admin, Budget Owner, Admin, or Access Reviewer is scoped to application responsibility. ## Recommended Access Model * Keep at least two trusted workspace Admins. * Give every important approved application one accountable Super Admin. * Add Budget Owners where subscription and renewal decisions need separate accountability. * Assign Access Reviewers before scheduling a certification campaign. * Review workspace and application roles when someone changes position or leaves. * Demote Admins and reassign application ownership promptly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://boza.gitbook.io/docs/settings-and-security/settings/roles-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.