> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-management/role-based-access-control.md).

# Role-Based Access Control

P0 roles control what actions users can perform within the platform. You can assign roles to individual users or to identity-provider groups (such as Okta groups).

### Global roles

#### Owner

Owners can add integrations and alter settings.

#### Security Reviewer

Security Reviewers can review access policies and user access (via P0 CLI), and you can optionally configure them as approvers for access requests in [Access Policies](/access-management/just-in-time-access/request-routing.md).

### Roles for Just-In-Time Access

**Requestor**

Every user that can log in to P0 is a Requestor. This is the default baseline role for your users.

#### Approver

Approvers can approve access requests.

The Approver role is only in use in either of these cases:

1. There are no access policies in place
2. There are access policies in place and they explicitly reference the P0 Approver role

See [Access Policies](/access-management/just-in-time-access/request-routing.md).

### Roles for IAM assessment

#### **Assessment Users**

Assessment Users can run, manage, and view the results of environment scans.

#### **Assessment Viewer**

Assessment Viewers can view the results of environment scans.

## Assigning roles

You can assign roles in **P0 Management** > **Access control** within the P0 app. Each role supports two assignment methods:

* **Users:** Assign the role directly to individual user email addresses.
* **Groups:** Assign the role to an identity-provider group (e.g., an Okta group). All members of that group inherit the role.

## Assigning roles to groups

If your organization signs in through [Okta](/integrations/directory-integrations/okta.md) (or another OIDC provider that emits a groups claim), you can map identity-provider groups to P0 roles. When you assign a group to a role, all members of that group automatically receive the role in P0.

Group mapping requires you to configure a `groups` claim in your identity provider and then enter the group names in **Admin** > **Access control**. For the full setup and troubleshooting steps, see [Group-based access control](/p0-management/group-based-access-control.md).