> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-management/role-based-access-control.md).

# Role-based access control

Configure role-based access control to enforce least-privileged access for your P0 Security users. Assign roles and manage permissions across your organization.

P0 roles control what actions users can perform within the platform. You can assign roles to individual users or to identity-provider groups (such as Okta groups).

### Global roles

#### Owners

Owners can add integrations and alter settings.

#### Security Reviewers

Security Reviewers can review access policies and user access (via P0 CLI), and you can optionally configure them as approvers for access requests in [Access Policies](/access-management/just-in-time-access/access-policies.md).

### Roles for Just-In-Time Access

#### Requestors

Every user that can log in to P0 is a Requestor. This is the default baseline role for your users.

#### Approvers

Approvers can approve access requests.

The Approver role is only in use in either of these cases:

1. There are no access policies in place
2. There are access policies in place and they explicitly reference the P0 Approver role

See [Access policies](/access-management/just-in-time-access/access-policies.md).

### Roles for IAM assessment

#### Assessment Users

Assessment Users can run, manage, and view the results of environment scans.

#### Assessment Viewers

Assessment Viewers can view the results of environment scans.

## Assigning roles

You can assign roles in **P0 Management** > **Access control** within the P0 app. Each role supports two assignment methods:

* **Users:** Assign the role directly to individual user email addresses.
* **Groups:** Assign the role to an identity-provider group (e.g., an Okta group). All members of that group inherit the role.

You can also assign roles as code with the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) (version `0.50.0` or later). Each role has a resource for individual users and one for identity-provider groups:

| Role              | User resource                                                                                                                      | Group resource                                                                                                                       |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Owner             | [`p0_owner_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/owner_user)                         | [`p0_owner_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/owner_group)                         |
| Security Reviewer | [`p0_security_reviewer_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/security_reviewer_user) | [`p0_security_reviewer_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/security_reviewer_group) |
| Assessment User   | [`p0_assessment_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_user)               | [`p0_assessment_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_group)               |
| Assessment Viewer | [`p0_assessment_viewer_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_viewer_user) | [`p0_assessment_viewer_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_viewer_group) |

## Assigning roles to groups

If your organization signs in through [Okta](/integrations/directory-integrations/okta.md) (or another OIDC provider that emits a groups claim), you can map identity-provider groups to P0 roles. When you assign a group to a role, all members of that group automatically receive the role in P0.

Group mapping requires you to configure a `groups` claim in your identity provider and then enter the group names in **Admin** > **Access control**. For the full setup and troubleshooting steps, see [Group-based access control](/p0-management/group-based-access-control.md).