> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Lumos Roles
## Background
Roles (Access Levels) in Lumos support delegated administration, so department heads and managers with the most context can manage their own IT and SaaS software instead of routing all requests through the IT department.
Lumos provides three layers of roles:
* **Built-in roles** (described below) with fixed permissions that cover the most common access patterns.
* **Org Roles** that let you compose your own organization-wide role from a granular permission catalog.
* **App Resource Roles** that let you customize what an App Admin can do for a specific app (for example, allow approvals and editing entitlement descriptions, but not editing provisioning workflows or approval workflow steps).
See [Getting Started with Custom Lumos Roles](/kb/ui-ux/general-lumos-settings/getting-started-with-custom-lumos-roles) for how to create, configure, and assign Org Roles and App Resource Roles.
## Admin
This is the **most privileged** role in Lumos. Users with the Admin role can see and do anything in Lumos. Only Admins can connect integrations. Assign the Admin role sparingly.
## Read Only Admin
Read Only Admins can view every page an Admin can view, but they cannot adjust any admin settings.
## AppStore Read Only Admin
This role can **view** the *AppStore* tab of the Activity Log, review all tasks in the Task Center, and view all AppStore configuration settings, but cannot act on tasks not assigned to them.
## Auditor
Auditors can view all Access Reviews, whether in progress or completed, and export PDF reports for Access Reviews. In addition, they can view the *Access Reviews* tab of the Activity Log.
## App Admin
If the user is a named App Admin for an app **and** has this role assigned to them, they can view and configure any of that app's settings in the AppStore (including approval/provisioning settings), as well as launch Access Reviews for that app.
If you want to give a user App Admin permissions only for *some* of an app's settings (for example, approvals only, not provisioning workflows), use an **App Resource Role**. See [Getting Started with Custom Lumos Roles](/kb/ui-ux/general-lumos-settings/getting-started-with-custom-lumos-roles) for the step-by-step.
## Vendor Owner
Vendor owners have the ability to read and write to all spend data in Lumos. They can:
* View the Vendor Agreements page
* View the Spend Analytics page
* View Orders, Invoices, and Expenses
* Edit Vendor Agreement details, such as Renewal Owners and custom attributes
* Create, update, and delete Orders
Note that invoices and expenses cannot be altered directly in Lumos.
## Vendor Agreement Owner
Vendor Agreement owners have the ability to view the Vendors tab and view/manage vendor records and agreements for **only** Agreements they are assigned to as a Renewal Owner. This role will give users just enough permissions to manage their Vendor Agreements without giving them access to every other Agreement inside Lumos. Today, the analytics page is unavailable to users with only this role.
## User
If given this role, a user can only view the AppStore and any accounts that have been assigned or delegated to them in an Access Review.
This is the default role for most users, and is required unless the user has "No Access".
## No Access
If given this role, the user will not be able to log into Lumos, request apps, have app requests submitted on their behalf, or be assigned to access reviews.
***
## Custom Roles
In addition to the built-in roles above, Lumos supports **Custom Roles**, which let admins define their own role with a specific combination of permissions. Custom Roles come in two types:
* **Org Roles** apply organization-wide. Useful when you want to give a user (or group) a tailored set of permissions across all of Lumos.
* **App Resource Roles** apply to one or more specific applications when assigned. Useful when you want to give a user App Admin–style permissions on a specific app but customize *which* App Admin capabilities they actually get.
The permission catalog is the same source of truth for both types, with the App Resource Role catalog scoped to only those permissions that make sense at the per-app level.
For step-by-step guidance on creating and assigning Custom Roles, see [Getting Started with Custom Lumos Roles](/kb/ui-ux/general-lumos-settings/getting-started-with-custom-lumos-roles).
### When to use an Org Role
Use an Org Role when you want a user to have a unique combination of organization-wide permissions that no built-in role covers. Common examples:
* A *Compliance Reviewer* who can view all access reviews, generate review reports, and view audit logs, but cannot manage anything else.
* A *Procurement Partner* who can view vendor agreements, manage spend records, and view dashboards, but has no access to AppStore configuration.
* A *Helpdesk Lead* who can view applications, manage access requests, and view activity logs, but cannot edit integrations or org settings.
### When to use an App Resource Role
Use an App Resource Role when you want to delegate a subset of App Admin capabilities for a specific app. Common examples:
* A team lead who should approve access requests for a single app but should not be able to change that app's provisioning workflows.
* A finance team member who should view all accounts and entitlements in a single app but not change anything.
* An app owner who should manage entitlement names and descriptions but not the integration settings.
App Resource Roles are assigned **per app**. The same Resource Role can be assigned to different users on different apps independently.
### Permission catalog
The Custom Role permission catalog is organized into three sections, mirroring the layout in **Settings → User Roles → Create Role**.
#### Org Role catalog
**Products**
* **Identity Intelligence** — Manage, View
* **Analytics** — Manage, View
* **AppStore Config** — Manage (Approvals, General), View (Approvals, General)
* **Access Requests** — Create, Manage, View
* **Access Reviews** — Create, Manage, View
* **SoD Policies** — Manage, View
* **Employee Lifecycle** — Manage (Movers, Offboardings, Onboardings), View (Movers, Offboardings, Onboardings)
**Inventory**
* **Apps** — Create; Manage (Accounts, Basic Details, Integration Settings, Permissions, Table Views, Workflows); View (Accounts, Basic Details, Permissions, Table Views, Workflows)
* **Identities** — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
* **Non-Human Identities** — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
* **Vendor Agreements** — Manage (Basic Details, Table Views), View (Basic Details, Table Views)
* **Spend Records** — Manage, View
* **Found Documents** — Manage, View
* **Access Policies** — Manage, View
* **Knowledge Hub** — Manage (Context, Skills, Table Views), View (Context, Skills, Table Views)
**Workspace**
* **Activity Logs** — View
* **MCP Governance** — Manage (Table Views, Tool Usage), View (Table Views, Tool Usage)
* **On-Prem Agents** — Manage, View
* **Org Settings** — Manage and View across Platform (Source of Truth, Data Properties, User Roles, Personalization, AppStore Settings, Vendor Settings, Notifications, ITSM, Escalation Policies, Shadow IT, Circuit Breakers) and Dev Tools (SIEM, Security, Webhooks, API Tokens)
* **Custom Attributes** — Manage
* **Tasks** — View
#### App Resource Role catalog
The App Resource Role catalog is intentionally narrower. It includes only the permissions that make sense at a per-app scope.
**Products**
* **AppStore Config** — Manage (Approvals, General), View (Approvals, General)
* **Access Requests** — Create, Manage
**Inventory**
* **Apps** — Manage (Accounts, Basic Details, Integration Settings, Permissions, Workflows), View (Accounts, Basic Details, Workflows)
**Workspace**
* **Tasks** — View
At the bottom of the permission picker, the UI shows: *"Additional permissions are not supported for this role."*
### Role lifecycle
* **Creation:** Admin only. Created in **Settings → User Roles → Create Role**.
* **Editing:** Permission changes take effect on each assigned user's next session.
* **Deletion:** Allowed. Any user assigned to a Custom Role will be unassigned before it is deleted
* **Limits:** No limit on the number of Custom Roles per tenant today.
* **API:** Custom Role creation and editing are not yet available via the public API. **Custom Org Role assignments** can be granted and revoked through the existing `POST /users/{user_id}/roles/{role_name}` and `DELETE /users/{user_id}/roles/{role_name}` endpoints, the same way as built-in roles, and are included in the `GET /users/{user_id}/roles` response. **App Resource Role assignments are not yet supported via the API.**
***
## Full Lumos Roles and Permissions Matrix
### Role Definitions
The matrix below describes the **built-in roles**. For Custom Roles, the permission catalog in the previous section is the source of truth for composable permissions.
| **Role** | **User-Friendly Name** | **Description** | **Scope** |
| - | - | - | - |
| ORGANIZATION\_ADMIN | Admin | Full administrative access to all features within the organization | Organization-wide |
| READ\_ONLY\_ORGANIZATION\_ADMIN | Read Only Admin | Read-only access to all features within the organization | Organization-wide |
| AUDITOR | Auditor | Read-only access specifically for access review auditing and compliance | Access Reviews only |
| APP\_ADMIN | App Admin | Manage specific applications they are assigned to administer. Capabilities are the full App Admin bundle by default and can be customized per app using an App Resource Role. | App-specific |
| APP\_STORE\_READ\_ONLY\_ADMIN | AppStore Read Only Admin | Read-only access to AppStore and related features | AppStore only |
| VENDOR\_OWNER | Vendor Owner | Full access to vendor management and contracts | Vendor management |
| VENDOR\_AGREEMENT\_OWNER | Vendor Agreement Owner | Manage specific vendor agreements they own | Agreement-specific |
| VENDOR\_QA\_USER | Vendor QA User | QA and testing access for vendor features (Lumos internal use) | Vendor QA |
| USER | User | Standard end-user access for requesting access and participating in reviews | Limited |
| LUMOS\_INTERNAL\_USER | Lumos Internal User | Lumos employee access (special internal use) | Internal only |
### Capabilities Matrix
Legend:
* Yes = Full access
* Read-only = Read-only access
* Limited = Conditional or limited access
* No = No access
This matrix reflects the built-in roles. For composable permissions, see the Custom Role catalog above.
| **Capability Category** | **Organization Admin** | **Read Only Admin** | **Auditor** | **App Admin** | **AppStore Read Only Admin** | **Vendor Owner** | **Vendor Agreement Owner** | **Vendor QA User** | **User** |
| - | - | - | - | - | - | - | - | - | - |
| **Applications and Integrations** | | | | | | | | | |
| View all applications | Yes | Read-only | No | Yes | Read-only | No | No | No | No |
| Connect/remove integrations | Yes | No | No | No | No | No | No | No | No |
| Manage integration settings | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Sync integration data | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Manage app basic details | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Manage app workflows | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| **AppStore** | | | | | | | | | |
| View AppStore items | Yes | Read-only | No | Yes | Read-only | Read-only | Read-only | Read-only | No |
| Manage AppStore settings | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Manage app visibility | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Manage request settings | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| Manage preapproval rules | Yes | No | No | Limited (own apps) | Read-only | No | No | No | No |
| Manage custom intake fields | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| **Accounts and Permissions** | | | | | | | | | |
| View accounts | Yes | Read-only | No | Limited (own apps) | No | Limited | No | No | No |
| Manage accounts | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| View entitlements/permissions | Yes | Read-only | No | Limited (own apps) | No | No | No | No | No |
| Manage entitlements/permissions | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| View groups | Yes | Read-only | No | Yes | Read-only | No | No | No | No |
| Import custom apps | Yes | No | No | Yes | No | No | No | No | No |
| **Access Requests** | | | | | | | | | |
| View all access requests | Yes | Read-only | No | Yes | Read-only | No | No | No | Limited (own requests) |
| Create access requests | Yes | No | No | No | No | No | No | No | Yes |
| Manage request approvers | Yes | No | No | Limited (own apps) | No | No | No | No | Limited (approve/reject) |
| **Access Reviews** | | | | | | | | | |
| View access reviews | Yes | Read-only | Read-only | No | No | No | No | No | Limited (as owner/reviewer) |
| Create access reviews | Yes | No | No | Yes | No | No | No | No | Limited (as owner) |
| Manage review campaigns | Yes | No | No | No | No | No | No | No | Limited (as owner) |
| Manage review app settings | Yes | No | No | No | No | No | No | No | Limited (as app admin) |
| Perform reviews | Yes | No | No | No | No | No | No | No | Limited (as reviewer) |
| Manage review assignments | Yes | No | No | No | No | No | No | No | Limited (as app admin) |
| Configure auto-removal | Yes | No | No | No | No | No | No | No | Limited (as app admin) |
| Upload manual evidence | Yes | No | No | No | No | No | No | No | Limited (as reviewer) |
| Download evidence | Yes | Read-only | Read-only | No | No | No | No | No | Limited (as reviewer) |
| Generate review reports | Yes | Read-only | Read-only | No | No | No | No | No | Limited (as owner) |
| **Identities and Users** | | | | | | | | | |
| View user information | Yes | Read-only | No | No | No | No | No | No | No |
| Manage user status | Yes | No | No | No | No | No | No | No | No |
| View/assign user roles | Yes | Read-only | No | No | No | No | No | No | Read-only (own role) |
| Manage identity settings | Yes | No | No | No | No | No | No | No | No |
| Assign app admins | Yes | No | No | Yes | No | No | No | No | No |
| Manage delegations | Yes | No | No | No | No | No | No | No | Limited (own delegations) |
| **Lifecycle Management (LCM)** | | | | | | | | | |
| View onboardings | Yes | Read-only | No | No | No | No | No | No | No |
| Create/manage onboardings | Yes | No | No | No | No | No | No | No | No |
| View offboardings | Yes | Read-only | No | No | No | No | No | No | No |
| Create/manage offboardings | Yes | No | No | No | No | No | No | No | No |
| View mover events | Yes | Read-only | No | No | No | No | No | No | No |
| Manage movers workflows | Yes | No | No | No | No | No | No | No | No |
| Manage offboarding flows | Yes | No | No | Limited (own apps) | No | No | No | No | No |
| **Access Policies** | | | | | | | | | |
| View access policies | Yes | Read-only | No | No | No | No | No | No | No |
| Create/manage access policies | Yes | No | No | No | No | No | No | No | No |
| View SOD policies | Yes | Read-only | No | No | No | No | No | No | No |
| Create/manage SOD policies | Yes | No | No | No | No | No | No | No | No |
| **Vendors and Contracts** | | | | | | | | | |
| View vendor agreements | Yes | Read-only | No | No | No | Yes | Limited (assigned agreements) | Yes | No |
| Create vendor agreements | Yes | No | No | No | No | Yes | No | Yes | No |
| Manage vendor agreements | Yes | No | No | No | No | Yes | Limited (assigned agreements) | Yes | No |
| Delete vendor agreements | Yes | No | No | No | No | Yes | Limited (assigned agreements) | Yes | No |
| View vendor reports | Yes | Read-only | No | No | No | Yes | No | No | No |
| View unreviewed contracts | Yes | Read-only | No | No | No | Yes | No | Yes | No |
| Manage unreviewed contracts | Yes | No | No | No | No | Yes | No | Yes | No |
| Ingest contracts | Yes | No | No | No | No | Yes | No | Yes | No |
| Manage vendor notifications | Yes | No | No | No | No | Yes | Limited (assigned agreements) | Yes | No |
| View/manage spend records | Yes | Read-only | No | No | No | Yes | No | Yes | No |
| Manage custom attributes | Yes | No | No | No | No | Limited (vendor attributes) | No | No | No |
| **Organization Settings** | | | | | | | | | |
| View org settings | Yes | Read-only | No | No | No | No | No | No | Read-only (limited) |
| Manage org settings | Yes | No | No | No | No | No | No | No | No |
| Manage branding | Yes | No | No | No | No | No | No | No | No |
| Manage login providers | Yes | No | No | No | No | No | No | No | No |
| Manage notification settings | Yes | No | No | No | No | No | No | No | No |
| View SIEM integration | Yes | Read-only | No | No | No | No | No | No | No |
| Manage SIEM integration | Yes | No | No | No | No | No | No | No | No |
| Manage ITSM integration | Yes | No | No | No | No | No | No | No | No |
| Manage escalation policies | Yes | No | No | No | No | No | No | No | No |
| Manage inline webhooks | Yes | No | No | No | No | No | No | No | No |
| View/manage API tokens | Yes | Read-only | No | No | No | No | No | No | No |
| **Activity Logs and Auditing** | | | | | | | | | |
| View activity logs | Yes | Read-only | Limited (access review logs only) | No | Read-only (app store logs) | No | No | No | No |
| Export activity logs | Yes | Read-only | No | No | Read-only | No | No | No | No |
| **Dashboards and Analytics** | | | | | | | | | |
| View dashboards | Yes | Read-only | No | No | No | No | No | No | No |
| Create/manage dashboards | Yes | No | No | No | No | No | No | No | No |
| **Data Exports** | | | | | | | | | |
| Export applications data | Yes | Read-only | No | Limited (own apps) | Read-only | No | No | No | No |
| Export AppStore data | Yes | Read-only | No | No | Read-only | No | No | No | No |
| Export access review data | Yes | Read-only | Read-only | No | Read-only | No | No | No | No |
| Export vendor data | Yes | Read-only | No | No | No | Yes | No | No | No |
| **Table Views** | | | | | | | | | |
| Manage All Apps table views | Yes | Read-only | No | No | No | No | No | No | No |
| Manage Vendor table views | Yes | Read-only | No | No | No | Yes | No | No | No |
| Manage Knowledge Hub views | Yes | Read-only | No | No | No | No | No | No | No |
| **On-Prem Agents** | | | | | | | | | |
| View on-prem agents | Yes | Read-only | No | No | No | No | No | No | No |
| Delete on-prem agents | Yes | No | No | No | No | No | No | No | No |
***
## Important Notes
1. **Organization Admin**: Has unrestricted access to all features and capabilities within their organization. This is the highest privilege level.
2. **Read Only Admin**: Can view all data but cannot make any modifications. Useful for auditors or analysts who need visibility without edit rights.
3. **Auditor**: Specifically designed for compliance auditing with read-only access to access review data, activity logs, and the ability to generate compliance reports.
4. **App Admin**: Scoped permissions — only has access to manage applications they are explicitly assigned to administer. They can view organization-wide app data but can only modify their assigned apps. Use an **App Resource Role** to customize *which* App Admin capabilities a user has for a given app.
5. **AppStore Read Only Admin**: Limited to viewing AppStore, support requests, and related activity logs. Useful for help desk or support teams.
6. **Vendor Owner**: Full access to vendor management features for the entire organization. Can manage all vendor agreements, contracts, and spend data.
7. **Vendor Agreement Owner**: Limited to specific vendor agreements they are assigned to own. Can only view and modify their assigned agreements.
8. **Vendor QA User**: Special role for Lumos internal QA testing of vendor features. Not intended for customer use.
9. **User**: Standard end-user role with minimal permissions — can create access requests, participate in access reviews when assigned, and manage their own delegations.
10. **Lumos Internal User**: Reserved for Lumos employees. Cannot be assigned to external users.
## Role Assignment Rules
* A user can have multiple roles simultaneously (e.g., USER + APP\_ADMIN, USER + an Org Role, USER + an App Resource Role on a specific app).
* Permissions are additive — having multiple roles grants the union of all permissions from those roles.
* App Admin assignments are app-specific and controlled separately from role assignments.
* Vendor Agreement Owner assignments are agreement-specific.
* **Custom Org Role** assignments behave like built-in roles — assigned from Settings → Lumos Members in the *Access Level* column.
* **App Resource Role** assignments are made per-app from the resource page (for example, the Apps page). The same Resource Role can be assigned to different users on different apps.
## Zone-Based Authorization
Lumos uses a zone-based authorization model where permissions are evaluated within specific "zones":
* **Domain Zone**: Organization-wide permissions
* **Domain App Administration Zone**: Permissions for apps the user administers
* **Access Review Zones**: Permissions for reviews the user owns or participates in
* **Vendor Zones**: Permissions for vendor agreements the user owns
* **Lumos User Zone**: Self-service permissions for the user's own account
This ensures that even with elevated roles like App Admin, users can only act on resources they're explicitly authorized to manage.
Custom Org Roles operate in the **Domain Zone**. App Resource Roles operate in the **Domain App Administration Zone** for the specific apps to which they are assigned. Other resource types (for example, policies and identities) will be added as additional resource scopes are introduced.
***
## FAQs
### Accessing your current user roles
You can view your users and their roles in Lumos under **Settings → Lumos Members** in the *Access Level* column.
You can also view or edit roles via the Lumos API, granted you have the proper permissions. **The API supports viewing, granting, and revoking both built-in roles and Custom Org Roles.** Custom Role creation and editing, and App Resource Role assignments, are not yet available via the public API.
| **Action** | **Endpoint** | **Necessary Permissions** |
| - | - | - |
| Viewing Roles | `GET /users/{user_id}/roles` | basic user (`USER`) can view their own roles; admin (`ORGANIZATION_ADMIN`) can view other users' roles |
| Granting Roles | `POST /users/{user_id}/roles/{role_name}` | admin (`ORGANIZATION_ADMIN`) can grant any role to any user; app admin (`APP_ADMIN`) can grant app admin role to any user |
| Revoking Roles | `DELETE /users/{user_id}/roles/{role_name}` | admin (`ORGANIZATION_ADMIN`) can revoke any role from any user; app admin (`APP_ADMIN`) can revoke app admin role from any user |
### Default roles
* The user used to create your Lumos tenant will be made an Admin (though this can be changed later).
* All users created, except for the first user that creates your tenant, will be set as a **User**.
* All inactive or suspended users in your Source of Truth will be set to "No Access".
* When a Custom Role is deleted, users no longer have that assignment. Any other roles they have assigned will remain.
If you see this error message: `You are not allowed to perform this action`, it means you do not have the correct Lumos Role or Access Review Role to perform the action.