# Roles and access

> The two levels of access in Umbreta, a role in the organization and a role on a profile, and the rights a profile's access is made of.

After this page you understand why a person sees some profiles and not others, and what they can do with them.

## Profiles belong to the organization

A person creates a profile, but the organization owns it. Access has two levels: the role in the organization decides which profiles a person sees, and the role on a profile decides what they do with that profile. The server checks every action; what a person may not do, the app doesn't even show.

## Role in the organization

The role is set in the organization's console under **Members**.

| Role | What they can do |
| --- | --- |
| **Admin** | Every profile and everyone's access, tags, warm-up templates, browser policies, browser builds, connections, publishing scenarios. |
| **Farmer** | Sees every profile of the organization: launches, edits, proxies and settings, grants access; no admin sections, deleting or handing over. |
| **Operator** | Creates their own profiles and works in the ones granted to them: launch, proxy, scenarios; no admin sections. |
| **Viewer** | Only looks at the profiles granted to them; launches and changes nothing. |

## Role on a profile

It is given in **People and access** → **Give a profile**, with no end date or until a date.

| Role | What they can do |
| --- | --- |
| **Owner** | The profile goes to the person: they launch it, change the proxy and settings, grant access to others. The organization's admins keep full access. |
| **Operator** | Launches and works in the browser, edits the note and tags, records scenarios. Can't hand over, delete or change the proxy. |
| **Viewer** | Sees the profile, its history and stats. Can't launch. |

## Rights

Behind a role are rights on the profile. They are on the **Access** tab of the profile card.

| Right | What it opens |
| --- | --- |
| **Launch** | Open on this computer, watch the window, run granted scenarios, save on close. |
| **Edit** | Name, note, tags, start tabs. |
| **Scenarios** | Record and edit scenarios on the profile, run any. |
| **Proxy** | Change the proxy, the IP, the exit type and country. |
| **Settings** | Device, language, moving to a new engine, policies. |
| **Archive** | Archive and restore. |
| **Access** | Grant or revoke access for other people. |
| **Cookies** | Export cookies and profile data. |

When a profile is created for another person, the **For** field takes a **Permission set**: **Launch only**, **Operator**, **Lead** (adds proxy and device settings) or **Full**. The creator stays the owner.

## When access ends

Access with an end date goes away by itself on the last day at 23:59 Kyiv time. When access is revoked or has expired, open launches close: the window closes and its tabs are saved to the cloud. A member disabled in the console loses access within a minute.