# Roles

> For the complete documentation index, see [llms.txt](https://www.jetbrains.com/help/air/llms.txt).

Access in Air Governance is role-based. Every role is some combination of [permissions](#permissions) that define what this role can do. You can either use [default roles](#default_roles) or create a new one and then assign it to principals: [users](users.html), [groups](groups.html), and [service accounts](service-accounts.html).

> **Note:**
> Managing roles is available only for users with the [Manage organization](#permissions_manage_org) permission.

Procedure: Create roles

1. In the sidebar, under Users and access, select Roles.

If you don't see this page, your role doesn't have the necessary [permissions](#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. In the top-right corner of the Roles page, click New role.

3. In the New role dialog, enter a name for the role.

4. Under Scope, select the [scope](#role-scopes) where the permissions of this role should apply: Organization or Groups.

5. Define the set of permissions for this role.

6. Click Create.

Procedure: Edit roles

1. In the sidebar, under Users and access, select Roles.

If you don't see this page, your role doesn't have the necessary [permissions](#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. Click the permissions assigned to the role.

Alternatively, click ... next to the role and select Edit role.

3. In the Edit role dialog, edit the permissions and the name of the role.

> **Note:**
> You can't change the [scope](#role-scopes) of a role.

4. Click Save changes to apply.

Procedure: Delete roles

1. In the sidebar, under Users and access, select Roles.

If you don't see this page, your role doesn't have the necessary [permissions](#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. Click ... next to the role and select Delete role.

3. Confirm deletion.

Procedure: Assign roles

You can assign roles to [principals](ai-governance.html#principal): users, groups, and service accounts. Assigning a role adds permissions that this role includes.

For information about assigning roles, see:

* [Manage user permissions](users.html#user_permissions)

* [Manage group permissions](groups.html#group_permissions)

* [Manage service account permissions](service-accounts.html#service-account-permissions)

## Permissions

Permissions define which sections of the UI the role has access to.

| Permission | [Users and access](users-and-access.html) | Licensing | Billing | [AI governance](ai-governance.html) | [AI analytics](ai-analytics.html) | Organization |
| [Users](users.html) | [Groups](groups.html) | [Roles](#intro) | [Service accounts](service-accounts.html) | Products and services | Licenses | Teams | Transactions and invoices | Spending report | Subscription packs | [Access](ai-access.html) | [Policies](ai-policies.html) | [Providers](ai-providers.html) | [Agents](ai-agents.html) | [MCP](air-gov-mcp-servers.html) | [Settings](ai-settings.html) | Contacts | Administration |
| [Manage organization](#permissions_manage_org) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) |
| [View organization members](#permissions_view_org) | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [Manage AI settings](#permissions_manage_ai_settings) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [View AI settings](#permissions_view_ai_settings) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [Manage AI access](#permissions_manage_ai_access) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [View AI access](#permissions_view_ai_access) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)* | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [View AI analytics](#permissions_view_ai_analytics) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg) | ![](images/cross.svg) | ![](images/cross.svg) |
| [View AI analytics (self)](#permissions_view_ai_analytics_self) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)** | ![](images/cross.svg) | ![](images/cross.svg) |
| [Manage licensing and billing](#permissions_manage_licensing_and_billing) | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/cross.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg) | ![](images/check.svg) |
| [Manage purchases](#permissions_manage_purchases) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg)* | ![](images/check.svg) | ![](images/check.svg) | ![](images/check.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)* |
| [View licenses](#permissions_view_licenses) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/check.svg)* | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/cross.svg) | ![](images/check.svg)* |

* Read-only access.

** Only for yourself.

### Manage organization

Allows managing everything in Air Governance.

Only the [Org admin](#org_admin) has this permission by default.

### View organization members

Allows viewing information about [users](users.html), [groups](users.html), [roles](#intro), and [service accounts](service-accounts.html).

Only the [Org viewer](#org_viewer) has this permission by default.

### Manage AI settings

Allows managing [AI settings](ai-settings.html), [providers](ai-providers.html), [policies](ai-policies.html), [agents](ai-agents.html), and [MCP servers](air-gov-mcp-servers.html).

Only the [AI admin](#ai_admin) has this permission by default.

### View AI settings

Allows viewing [AI settings](ai-settings.html), [providers](ai-providers.html), [policies](ai-policies.html), [agents](ai-agents.html), and [MCP servers](air-gov-mcp-servers.html).

Only the [AI viewer](#ai_viewer) has this permission by default.

### Manage AI access

Allows managing [AI access](ai-access.html).

Only the [AI admin](#ai_admin) has this permission by default.

### View AI access

Allows viewing [AI access](ai-access.html).

Only the [AI viewer](#ai_viewer) has this permission by default.

### View AI analytics

Allows viewing [AI analytics](ai-analytics.html).

The following [default roles](#default_roles) have this permission by default:

* [AI admin](#ai_admin)

* [AI viewer](#ai_viewer)

* [AI analytics viewer](#ai_analytics_viewer)

### View AI analytics (self)

Allows viewing [AI analytics](ai-analytics.html) for the currently logged-in user only. With this permission, the user can access the `AI analytics` section in Air Governance and see their own data in analytics charts and tables. This permission doesn't let users see organization-wide, group-level, or other users’ metrics.

If this is the only permission that gives a user access to AI analytics, they see only their own data, and Air Governance doesn't show the following parts of the `AI analytics` section that are meaningful only when the data covers more than one AI consumer:

* The [Credit consumption](ai-credits-consumption.html) page

* The filter that selects principals or users on any of the remaining AI analytics pages: [Adoption and usage](ai-adoption-and-usage.html), [Activity and impact](ai-activity-and-impact.html), [Providers and models](ai-providers-and-models.html), and [Session explorer](session-explorer.html)

* The Initiated by column in [Session explorer](session-explorer.html)

This permission is not included in any default role. For a user to access and see their own metrics, a role that includes this permission must be assigned manually to the user or to a group they belong to.

### Manage licensing and billing

Allows purchasing and assigning licenses, managing billing, teams, contacts, and global org settings. Also allows viewing information about [users](users.html), [groups](users.html), and [roles](#intro).

Only the [Licensing and billing manager](#licensing-and-billing-manager) has this permission by default.

### Manage purchases

Allows purchasing licenses, managing billing, viewing teams and global org settings.

The following [default roles](#default_roles) have this permission by default:

* [Licensing and billing manager](#licensing-and-billing-manager)

* [Purchase manager](#purchase-manager)

### View licenses

Allows viewing licenses, teams, and global org settings.

The following [default roles](#default_roles) have this permission by default:

* [Licensing and billing manager](#licensing-and-billing-manager)

* [Purchase manager](#purchase-manager)

* [License viewer](#license-viewer)

## Default roles

Air Governance defines several default roles.

### Org admin

A primary organization admin role with management access to everything.

Default permissions:

* [Manage organization](#permissions_manage_org)

### Org viewer

A role with read-only access to organization members in Air Governance.

Default permissions:

* [View organization members](#permissions_view_org)

### AI admin

A role with management access to AI-related pages.

Default permissions:

* [Manage AI settings](#permissions_manage_ai_settings)

* [Manage AI access](#permissions_manage_ai_access)

* [View AI analytics](#permissions_view_ai_analytics)

### AI viewer

A role with read-only access to AI-related pages.

Default permissions:

* [View AI settings](#permissions_view_ai_settings)

* [View AI access](#permissions_view_ai_access)

* [View AI analytics](#permissions_view_ai_analytics)

### AI analytics viewer

A role with access only to AI analytics.

Default permissions:

* [View AI analytics](#permissions_view_ai_analytics)

### Licensing and billing manager

A role with management access to licensing and billing – not only purchasing licenses but also assigning them.

Default permissions:

* [Manage licensing and billing](#permissions_manage_licensing_and_billing)

* [Manage purchases](#permissions_manage_purchases)

* [View licenses](#permissions_view_licenses)

### Purchase manager

A role for license procurement – purchasing licenses but not assigning them.

Default permissions:

* [Manage purchases](#permissions_manage_purchases)

* [View licenses](#permissions_view_licenses)

### License viewer

A role for read-only billing oversight.

Default permissions:

* [View licenses](#permissions_view_licenses)

### JetBrains Context administrator

A role with management access to the [Air Context](jetbrains-context.html) page: viewing and changing the indexing settings and the indexed repositories of the organization.

## Role scopes

Every role has a scope that determines where its permissions apply.

* Organization for roles with permissions that should apply across the entire organization.

* Groups for roles with permissions that should apply only within a specific [group](groups.html). For example, a team lead can have group-scoped permissions to manage AI access for their group's members only.

> **Note:**
> You can only define the scope when creating a role. If you need to change the scope, create a new role.

Not all permissions support group scopes. A role scoped to groups can only have the following permissions:

* [Manage AI access](#permissions_manage_ai_access)

* [View AI access](#permissions_view_ai_access)

* [View AI analytics](#permissions_view_ai_analytics)

## See also

### Concepts

[Users](users.html) [Groups](groups.html) [Service accounts](service-accounts.html)