> ## Documentation Index
> This page is part of the Cloudinary Assets product. Fetch the complete documentation index for Cloudinary Assets at: https://cloudinary.com/documentation/llms-cloudinary-assets.txt?referrer=docpage and then use it to discover all relevant pages before exploring further.
> If your task extends beyond this product, fetch the top-level index covering all Cloudinary products and topics at: https://cloudinary.com/documentation/llms.txt?referrer=docpage

# Roles and permissions overview


[new-permissions-link]: dam_admin_permissions
[old-permission-link]: dam_admin_users_groups#role_based_permissions
[access-bundles-link]: dam_admin_permissions#access_bundles
This guide describes the Roles and Permissions system. For details on all roles available in the legacy system, see [Role-based permissions](user_provisioning#role_based_permissions).

> **INFO**:
>
> :title=Which permissions system do you have?
> Use the rollout schedule to find out:

> * **Free and self-serve paid accounts**: All free and self-serve paid accounts have been migrated to the new Roles and Permissions system.

> * **Enterprise accounts**: Enterprise rollout has begun. If your team hasn't already been moved with Cloudinary's help, you're still on the legacy system.
> You can confirm which permissions system you have. Open **Console Settings** and look for **Role Management**. If it's listed, your account is on Roles and Permissions. If it isn't listed, you're still on the legacy permissions model. 
> ![Global role management](https://cloudinary-res.cloudinary.com/image/upload/f_auto/q_auto/bo_1px_solid_grey/roles_interface.png "thumb: w_800,dpr_2, width:800, with_code:false, with_url:false")
> The Roles and Permissions system provides more granular, flexible access control than the legacy system. 

> * For a quick comparison, see [Roles and Permissions vs. legacy](dam_admin_users_groups#roles_and_permissions_vs_legacy). 

> * If your account is being migrated, see [Migrating to Roles and Permissions](permissions_migration) to understand what changes.

## Overview
> **NOTE**: :title=Plan availability:

On all plans, you can manage and assign [system roles](#system_and_custom_roles) in the Console, and assign folder roles to API keys and other principals programmatically via the [Admin API](permissions_assign_roles_api#assign_folder_roles_via_the_admin_api).[Custom roles](#system_and_custom_roles) and the Permissions API, which lets you manage roles programmatically, are available on **Enterprise plans only**. They aren't available on the Free plan or on self-serve paid plans.

Cloudinary roles help you control who can do what in your account and product environments. You can assign roles to principals (users, groups, or API keys) to give them the right level of access to features, settings, and content, such as folders and collections. For example, you might give your design team access to edit images in specific folders, while limiting your marketing team to view-only access.

You can customize roles with granular permissions to fit how your teams work, whether you're managing different brands, assigning access based on job functions, or organizing teams by region or department.


### Roles and permissions video tutorial

New to roles and permissions? Watch this short intro video.

  This video is brought to you by Cloudinary's video player - embed your own!Use the controls to set the playback speed, navigate to chapters of interest and select subtitles in your preferred language.
{videoTranscript:publicId=training/permissions_intro_non_dev}

#### Tutorial contents This tutorial presents the following topics. Click a timestamp to jump to that part of the video.### Why roles and permissions matter
{table:class=tutorial-bullets}|  |
| --- | --- |
| | As your team grows, different people need different levels of access. A designer may need to find and use approved assets, a developer may need to create transformations, configure upload presets, or set up webhook notifications, and an administrator may need to manage users, settings, and access across the product environment. |

### Roles, principals, and role types
{table:class=tutorial-bullets}|  |
| --- | --- |
| | Roles bring together the permissions needed for each responsibility. Assign roles to users or groups to control what people can do in the Console, or to API keys to control what's allowed programmatically. All accounts can use predefined [system roles](dam_admin_system_roles_permissions#system_roles), and Enterprise customers can also create [custom roles](dam_admin_role_management#manage_roles_with_granular_permissions) with the permissions that match how their organization works. |

### Account and product environment roles
{table:class=tutorial-bullets}|  |
| --- | --- |
| | Account roles control access across the account, such as who can manage account-wide users, groups, or reports. Product environment roles control access to assets and to the features used to manage and deliver them within a product environment. A role includes either account permissions or product environment permissions, not both, but you can assign someone roles from both categories. |

### Global and content roles
{table:class=tutorial-bullets}|  |
| --- | --- |
| | Product environment roles are further divided into global roles and content roles. Global roles control access to features and settings across the product environment, such as moderating assets in all folders or configuring upload presets. Content roles ([folder and collection roles](dam_admin_permissions#key_role_attributes)) control access to specific folders or collections. To understand what a role allows, click **View** to see its permissions. |

### Assigning roles to users
{table:class=tutorial-bullets}|  |
| --- | --- |
| | When you add a user, you can assign an [access bundle](dam_admin_permissions#access_bundles), which pairs account and product environment roles at the same level, or assign roles individually. Each user can have one bundle. Access is additive, so a user with several roles receives all the permissions included in each of them. If you have multiple product environments, you can assign a user different roles in each one, for example Master Admin in staging but only Admin in production. |

### Assigning roles to groups
{table:class=tutorial-bullets}|  |
| --- | --- |
| | You can also assign roles to groups, so everyone in the group receives the permissions included in those roles. See [Create and manage groups](dam_admin_role_management#create_and_manage_groups). |

### Giving access to specific folders and collections
{table:class=tutorial-bullets}|  |
| --- | --- |
| | To give users access to specific assets in the Media Library based on their folders and collections, first assign the **Media Library User** role, then add content roles from the folder or collection you want to share. See [Assign folder and collection roles to users and groups](dam_admin_role_management#assign_folder_and_collection_roles_to_users_and_groups). |

### Assigning roles to API keys
{table:class=tutorial-bullets}|  |
| --- | --- |
| | Product environment API keys have two basic roles: **Master Admin**, which provides access to all Upload and Admin API endpoints, and **Media Library User**, which limits actions to assets in shared folders. On Enterprise plans, you can create granular API key roles, for example one that allows uploading but not deleting assets. After assigning a role, share the API key with the appropriate developer. Account management keys (Enterprise only), used for account provisioning and managing roles and permissions, can also have roles. See [Assign roles to API keys](dam_admin_role_management#assign_roles_to_api_keys). |

### Summary
{table:class=tutorial-bullets}|  |
| --- | --- |
| | With roles and permissions, you can give people and integrations the access they need while keeping control of the rest. |

You can also view these contents on the [Roles and permissions video tutorial](assets_onboarding_permissions_tutorial) page.
## Who you can assign roles to

**Principals** are actors in your Cloudinary account and product environments that you can assign roles to. 

They can be:

* **Users**: Named users with login access to the Console.Roles control which areas of the Console a user can access.
* **Groups**: Groups of users.Roles assigned to a group apply to all users within it.
* **Product environment API keys**: Used for programmatic access to a product environment.Roles determine the actions the key can perform via the **Admin** and **Upload** APIs.
* **Account Management Keys**: Used to perform account administrative tasks, e,g. user provisioning.  Roles determine the actions the key can perform via the **Provisioning** and **Permissions** APIs. 

> **NOTE**: Roles don't apply to the [account root management key](account_settings#root_account_management_key) or the [product environment root API key](product_environment_settings#root_api_key) since these keys automatically have full administrative permissions for their scope.

## Key role attributes

Cloudinary supports three types of roles: **global**, **folder**, and **collection**. 

Each type of role is scoped to either the **account** or one or more **product environments**, and is relevant to a different set of principals:

{table:class=no-borders overview}Role Type | Permission Level (Scope) | Description | Applies to | System Roles
---|---|---|---|---
**Global** | Account | Controls permissions for **account-wide** features, such as user management and billing. | **Users**, **groups**, and **account management keys** | [View predefined global account-level roles](dam_admin_system_roles_permissions#global_account_level_roles) |
**Global** | Product environment | Controls permissions for specific capabilities (such as upload presets and transformations), or across all folders and collections in a **product environment**. | **Users**, **groups**, and **product environment API keys** **Note:** Some global product environment roles also apply to account management keys | [View predefined global product environment-level roles](dam_admin_system_roles_permissions#global_product_environment_level_roles) |
**Folder** | Product environment | Controls permissions for specific folders and their assets. | **Users**, **groups**, and **product environment API keys** **Note:** Folder roles can only be assigned to API keys [programmatically](permissions_assign_roles_api#assign_folder_roles_via_the_admin_api) | [View predefined folder roles](dam_admin_system_roles_permissions#folder_roles) |
**Collection** | Product environment | Controls permissions for specific collections in the Media Library. | **Users** and **groups** only | [View predefined collection roles](dam_admin_system_roles_permissions#collection_roles) |

* [How to manage roles with granular permissions](dam_admin_role_management#manage_roles_with_granular_permissions)

* [How to assign those roles](dam_admin_role_management#assign_roles)

## System and custom roles

Each role is either a **system** or **custom** role type:

* **System roles** are predefined by Cloudinary and include a fixed set of permissions. They support most common workflows, and are immediately ready for you to assign.For a full list of available system roles and what each one allows, see [System roles and permissions](dam_admin_system_roles_permissions).
* **Custom roles** let you define your own roles based on what your team needs. You choose which set of permissions to include in each role.

System roles can apply globally (at the account level or per product environment), to folders, and to collections.

You can create custom roles that apply globally and to folders.

> **NOTE**: :title=Plan availability:

Creating custom roles requires an **Enterprise plan**. On the Free plan and on self-serve paid plans, use system roles and [access bundles](#access_bundles) instead.

## Quick setup with access bundles
The easiest way to get started with role assignment is using **access bundles**, predefined combinations of roles designed for common user types. Each bundle translates into a set of roles applied at the appropriate level (account or product environment) across all product environments.

Access bundles are ideal for:

* Teams with straightforward access needs
* Quick onboarding without diving into granular role management
* Organizations with fewer users who don't need custom role configurations

Available access bundles include:

* **Master Admin**: Full account and product environment access
* **Admin**: Full access except account management and billing
* **Technical Admin**: Full access except user/account management and billing
* **Billing**: Billing and usage reports only
* **Reports**: Reporting access only
* **Media Library Admin**: Full Media Library management
* **Media Library User**: Controlled Media Library access

You can select an access bundle when [inviting new users](dam_admin_role_management#define_access_when_inviting_new_users), or customize access by manually assigning specific roles.

## Concept summary

This table brings together all the key concepts covered on this page:

{table:class=no-borders overview} | Global Roles | Folder Roles | Collection Roles
--------|--------------|--------------|------------------
**Assignable to** | Users, groups, API keys | Users, groups  **Note:** You can assign API keys programmatically. | Users, groups
**Management location** | **Console Settings > Role Management > Global Roles** |  **Console Settings > Role Management > Folder Roles** |  **Console Settings > Role Management > Collection Roles**
**Assignment location** |  Assign to users:**Console Settings > User Management**Assign to API keys:**Console Settings > API Keys**Assign to account management keys:**Console Settings > Account Management Keys** | Media Library (folder sharing) | Media Library (collection sharing)
**Permission level** | Account or product environment | Product environment | Product environment
**Management type** | System or custom | System or custom | System

## Next steps

* [Role management](dam_admin_role_management): Manage your roles in the Console and assign them to users, groups, and API keys.
* [System roles and permissions](dam_admin_system_roles_permissions): Learn which roles and permissions Cloudinary offers and what each one allows.