Every role is a named set of permissions, and its members are the people who carry them. The Roles tab of the Policy area is where you see who holds a role, add or remove people, and choose which other roles it builds on.
Assigning members
Each role keeps its own list of members — the people who hold that role and everything it grants. Open the Roles tab, then select a role to see its members alongside the role's name, description, and permissions. When no one holds it, the role reads "No one holds this role yet."
To give someone a role:
- Open the Roles tab and select the role from the list. Narrow a long list with the Search roles box.
- In the role's members section, open the Add a person… picker and choose the person.
- Choose Add to grant them the role.
From then on, that person carries every permission the role grants. Each person who holds a role gains the same set of permissions, so reach for roles when a group of people should share the same access. To take the role back, remove the person from the same members list.
A role grants the same permissions everywhere they apply. To give one person access to a single part of the directory or one item rather than a whole area, share that item with them instead — see sharing.
Inheritance
A role can build on others. In a role's detail, the Inherits from picker sets which roles it inherits, and the field spells out the effect: "This role gains every permission of the roles it inherits. Highest permission always wins."
When a role inherits from another, it carries every permission of that role on top of its own grants. Where the same permission is set at more than one level, the most permissive grant applies. This lets you define a base role once — a shared set of everyday permissions — and layer narrower roles on top without granting the same permissions again.
When more than one of a role's sources grants the same permission, the strongest grant is the one that counts. As the field puts it, "Highest permission always wins."
The role's detail summarises the combined result under WHAT THIS ROLE GRANTS, so you can confirm the effective access — direct and inherited — before you keep it. Adjust the Inherits from picker, then choose Save changes to apply the update.