Background
Roles (Access Levels) in Lumos support delegated administration. Department heads and managers with the most context can manage their own IT and SaaS software instead of routing all requests through the IT department.
Lumos provides three layers of roles:
- Built-in roles (described below) with fixed permissions that cover the most common access patterns.
- Org Roles that let you compose your own organization-wide role from a granular permission catalog.
- App Resource Roles that let you customize what an App Admin can do for a specific app (for example, allow approvals and editing entitlement descriptions, but not editing provisioning workflows or approval workflow steps).
See Getting Started with Custom Lumos Roles for how to create, configure, and assign Org Roles and App Resource Roles.
Admin
This is the most privileged role in Lumos. Users with the Admin role can see and do anything in Lumos. Only Admins can connect integrations. Assign the Admin role sparingly.
Read Only Admin
Read Only Admins can view every page an Admin can view, but they cannot adjust any admin settings.
AppStore Read Only Admin
This role can view the AppStore tab of the Activity Log, review all tasks in the Task Center, and view all AppStore configuration settings. Users with this role cannot act on tasks that aren’t assigned to them.
Auditor
Auditors can view all Access Reviews, whether in progress or completed, and export PDF reports for Access Reviews. In addition, they can view the Access Reviews tab of the Activity Log.
App Admin
If a user is a named App Admin for an app and has this role assigned, they can view and configure any of that app’s settings in the AppStore, including approval/provisioning settings. They can also launch Access Reviews for that app.
If you want to give a user App Admin permissions only for some of an app’s settings (for example, approvals only, not provisioning workflows), use an App Resource Role. See Getting Started with Custom Lumos Roles for the step-by-step.
Vendor Owner
Vendor Owners can read and write to all spend data in Lumos. They can:
- View the Vendor Agreements page
- View the Spend Analytics page
- View Orders, Invoices, and Expenses
- Edit Vendor Agreement details, such as Renewal Owners and custom attributes
- Create, update, and delete Orders
You cannot alter invoices and expenses directly in Lumos.
Vendor Agreement Owner
Vendor Agreement Owners can view the Vendors tab and view/manage vendor records and agreements for only Agreements they are assigned to as a Renewal Owner. This role provides enough permissions to manage assigned Vendor Agreements without access to every other Agreement in Lumos. Today, the analytics page is unavailable to users with only this role.
User
If given this role, a user can only view the AppStore and any accounts that have been assigned or delegated to them in an Access Review.
This is the default role for most users, and is required unless the user has “No Access”.
No Access
If given this role, the user cannot log in to Lumos, request apps, have app requests submitted on their behalf, or be assigned to Access Reviews.
Custom Roles
In addition to the built-in roles above, Lumos supports Custom Roles, which let admins define their own role with a specific combination of permissions. Custom Roles come in two types:
- Org Roles apply organization-wide. Useful when you want to give a user (or group) a tailored set of permissions across all of Lumos.
- App Resource Roles apply to one or more specific applications when assigned. Useful when you want to give a user App Admin–style permissions on a specific app but customize which App Admin capabilities they actually get.
The permission catalog is the same source of truth for both types, with the App Resource Role catalog scoped to only those permissions that make sense at the per-app level.
For step-by-step guidance on creating and assigning Custom Roles, see Getting Started with Custom Lumos Roles.
When to use an Org Role
Use an Org Role when you want a user to have a unique combination of organization-wide permissions that no built-in role covers. Common examples:
- A Compliance Reviewer who can view all Access Reviews, generate review reports, and view audit logs, but cannot manage anything else.
- A Procurement Partner who can view vendor agreements, manage spend records, and view dashboards, but has no access to AppStore configuration.
- A Helpdesk Lead who can view applications, manage access requests, and view activity logs, but cannot edit integrations or org settings.
When to use an App Resource Role
Use an App Resource Role when you want to delegate a subset of App Admin capabilities for a specific app. Common examples:
- A team lead who should approve access requests for a single app but should not be able to change that app’s provisioning workflows.
- A finance team member who should view all accounts and entitlements in a single app but not change anything.
- An app owner who should manage entitlement names and descriptions but not the integration settings.
App Resource Roles are assigned per app. The same Resource Role can be assigned to different users on different apps independently.
Permission catalog
The Custom Role permission catalog is organized into three sections, mirroring the layout in Settings → User Roles → Create Role.
Org Role catalog
Products
- Identity Intelligence — Manage, View
- Analytics — Manage, View
- AppStore Config — Manage (Approvals, General), View (Approvals, General)
- Access Requests — Create, Manage, View
- Access Reviews — Create, Manage, View
- SoD Policies — Manage, View
- Employee Lifecycle — Manage (Movers, Offboardings, Onboardings), View (Movers, Offboardings, Onboardings)
Inventory
- Apps — Create; Manage (Accounts, Basic Details, Integration Settings, Permissions, Table Views, Workflows); View (Accounts, Basic Details, Permissions, Table Views, Workflows)
- Identities — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
- Non-Human Identities — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
- Vendor Agreements — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
- Spend Records — Manage, View
- Found Documents — Manage, View
- Access Policies — Manage, View
- Knowledge Hub — Manage (Context, Skills, Table Views), View (Context, Skills, Table Views)
Workspace
-
Activity Logs — View
-
MCP Governance — Manage (Table Views, Tool Usage), View (Table Views, Tool Usage)
-
On-Prem Agents — Manage, View
-
Org Settings — Manage and View across Platform (Source of Truth, Data Properties, User Roles, Personalization, AppStore Settings, Vendor Settings, Notifications, ITSM, Escalation Policies, Shadow IT, Circuit Breakers) and Dev Tools (SIEM, Security, Webhooks, API Tokens)
-
Custom Attributes — Manage
-
Tasks — View
App Resource Role catalog
The App Resource Role catalog is intentionally narrower. It includes only the permissions that make sense at a per-app scope.
Products
- AppStore Config — Manage (Approvals, General), View (Approvals, General)
- Access Requests — Create, Manage
Inventory
- Apps — Manage (Accounts, Basic Details, Integration Settings, Permissions, Workflows), View (Accounts, Basic Details, Workflows)
Workspace
At the bottom of the permission picker, the UI shows: “Additional permissions are not supported for this role.”
Role lifecycle
- Creation: Admin only. Created in Settings → User Roles → Create Role.
- Editing: Permission changes take effect on each assigned user’s next session.
- Deletion: Allowed. Lumos unassigns any user assigned to a Custom Role before deleting the role.
- Limits: No limit on the number of Custom Roles per tenant today.
- API: Custom Role creation and editing are not yet available via the public API. Custom Org Role assignments can be granted and revoked through the existing
POST /users/{user_id}/roles/{role_name} and DELETE /users/{user_id}/roles/{role_name} endpoints, the same way as built-in roles. They are also included in the GET /users/{user_id}/roles response. App Resource Role assignments are not yet supported via the API.
Full Lumos Roles and Permissions Matrix
Role Definitions
The matrix below describes the built-in roles. For Custom Roles, the permission catalog in the previous section is the source of truth for composable permissions.
Capabilities Matrix
Legend:
- Yes = Full access
- Read-only = Read-only access
- Limited = Conditional or limited access
- No = No access
This matrix reflects the built-in roles. For composable permissions, see the Custom Role catalog above.
Important Notes
- Organization Admin: Has unrestricted access to all features and capabilities within their organization. This is the highest privilege level.
- Read Only Admin: Can view all data but cannot make any modifications. Useful for auditors or analysts who need visibility without edit rights.
- Auditor: Specifically designed for compliance auditing with read-only access to Access Review data, activity logs, and the ability to generate compliance reports.
- App Admin: Has scoped permissions to manage only the applications they are explicitly assigned to administer. They can view organization-wide app data but can only modify their assigned apps. Use an App Resource Role to customize which App Admin capabilities a user has for a given app.
- AppStore Read Only Admin: Limited to viewing AppStore, support requests, and related activity logs. Useful for help desk or support teams.
- Vendor Owner: Full access to vendor management features for the entire organization. Can manage all vendor agreements, contracts, and spend data.
- Vendor Agreement Owner: Limited to specific vendor agreements they are assigned to own. Can only view and modify their assigned agreements.
- Vendor QA User: Special role for Lumos internal QA testing of vendor features. Not intended for customer use.
- User: Standard end-user role with minimal permissions. Can create access requests, participate in Access Reviews when assigned, and manage their own delegations.
- Lumos Internal User: Reserved for Lumos employees. Cannot be assigned to external users.
Role Assignment Rules
- A user can have multiple roles simultaneously (e.g., USER + APP_ADMIN, USER + an Org Role, USER + an App Resource Role on a specific app).
- Permissions are additive. Having multiple roles grants the union of all permissions from those roles.
- App Admin assignments are app-specific and controlled separately from role assignments.
- Vendor Agreement Owner assignments are agreement-specific.
- Custom Org Role assignments behave like built-in roles. You assign them from Settings → Lumos Members in the Access Level column.
- App Resource Role assignments are made per-app from the resource page (for example, the Apps page). The same Resource Role can be assigned to different users on different apps.
Zone-Based Authorization
Lumos uses a zone-based authorization model where permissions are evaluated within specific “zones”:
- Domain Zone: Organization-wide permissions
- Domain App Administration Zone: Permissions for apps the user administers
- Access Review Zones: Permissions for reviews the user owns or participates in
- Vendor Zones: Permissions for vendor agreements the user owns
- Lumos User Zone: Self-service permissions for the user’s own account
This ensures that even with elevated roles like App Admin, users can only act on resources they’re explicitly authorized to manage.
Custom Org Roles operate in the Domain Zone. App Resource Roles operate in the Domain App Administration Zone for the specific apps to which they are assigned. Other resource types (for example, policies and identities) will be added as additional resource scopes are introduced.
FAQs
Accessing your current user roles
You can view your users and their roles in Lumos under Settings → Lumos Members in the Access Level column.
You can also view or edit roles via the Lumos API if you have the proper permissions. The API supports viewing, granting, and revoking both built-in roles and Custom Org Roles. Custom Role creation and editing, and App Resource Role assignments, are not yet available via the public API.
Default roles
- The user who created your Lumos tenant is assigned the Admin role. You can change this later.
- All users created, except for the first user that creates your tenant, are set as User.
- All inactive or suspended users in your Source of Truth are set to “No Access”.
- When a Custom Role is deleted, users no longer have that assignment. Any other roles assigned to them remain.
If you see this error message: You are not allowed to perform this action, it means you do not have the correct Lumos Role or Access Review Role to perform the action.
