> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-management/role-based-access-control.md).

# Role-based access control

P0 roles control what actions users can perform within the platform. You can assign roles to individual users or to identity-provider groups (such as Okta groups).

### Global roles

#### Owners

Owners can add integrations and alter settings.

#### Security Reviewers

Security Reviewers can review access policies and user access (via P0 CLI), and you can optionally configure them as approvers for access requests in [Access Policies](/access-management/just-in-time-access/access-policies.md).

### Roles for Just-In-Time Access

#### Requestors

Every user that can log in to P0 is a Requestor. This is the default baseline role for your users.

#### Approvers

Approvers can approve access requests.

The Approver role is only in use in either of these cases:

1. There are no access policies in place
2. There are access policies in place and they explicitly reference the P0 Approver role

See [Access policies](/access-management/just-in-time-access/access-policies.md).

### Roles for IAM assessment

#### Assessment Users

Assessment Users can run, manage, and view the results of environment scans.

#### Assessment Viewers

Assessment Viewers can view the results of environment scans.

## Assigning roles

You can assign roles in **P0 Management** > **Access control** within the P0 app. Each role supports two assignment methods:

* **Users:** Assign the role directly to individual user email addresses.
* **Groups:** Assign the role to an identity-provider group (e.g., an Okta group). All members of that group inherit the role.

You can also assign roles as code with the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) (version `0.50.0` or later). Each role has a resource for individual users and one for identity-provider groups:

| Role              | User resource                                                                                                                      | Group resource                                                                                                                       |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Owner             | [`p0_owner_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/owner_user)                         | [`p0_owner_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/owner_group)                         |
| Security Reviewer | [`p0_security_reviewer_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/security_reviewer_user) | [`p0_security_reviewer_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/security_reviewer_group) |
| Assessment User   | [`p0_assessment_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_user)               | [`p0_assessment_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_group)               |
| Assessment Viewer | [`p0_assessment_viewer_user`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_viewer_user) | [`p0_assessment_viewer_group`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/assessment_viewer_group) |

## Assigning roles to groups

If your organization signs in through [Okta](/integrations/directory-integrations/okta.md) (or another OIDC provider that emits a groups claim), you can map identity-provider groups to P0 roles. When you assign a group to a role, all members of that group automatically receive the role in P0.

Group mapping requires you to configure a `groups` claim in your identity provider and then enter the group names in **Admin** > **Access control**. For the full setup and troubleshooting steps, see [Group-based access control](/p0-management/group-based-access-control.md).