> ## Documentation Index
> Fetch the complete documentation index at: https://valuemap.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

ValueMap has four roles, each with a different scope of access. Understanding how they differ, especially where access is scoped to specific groups, is key to setting up your organization correctly.

<Note>
  **Downstream access**<br />Permissions are hierarchical. A user granted access at a given level automatically inherits the equivalent permissions for all nested levels beneath it. For example, a Portfolio contributor has access to every product and initiative within that portfolio.
</Note>

## The four roles

| Role        | Access                                                                                               | Scope                                                        |
| :---------- | :--------------------------------------------------------------------------------------------------- | :----------------------------------------------------------- |
| Super Admin | Full access to all settings, all data, and all actions                                               | Entire organization                                          |
| Admin       | Full access to all settings, all data, and all actions, except billing and deleting the organization | Entire organization                                          |
| Contributor | Can view and edit                                                                                    | Groups they're invited to, and everything below those groups |
| Viewer      | Can view only                                                                                        | Groups they're invited to, and everything below those groups |

## Super Admin

The Super Admin has unrestricted access to everything in the organization, every setting, every group's data, and every action, including billing and the ability to delete the organization itself.

**There is always exactly one Super Admin per organization.** If you need to transfer this role to someone else, you'll need to explicitly reassign it; the role can't be shared or held by more than one person at a time.

## Admin

Admin mirrors Super Admin's access with two exceptions: Admins cannot access billing, and cannot delete the organization. Everything else, including managing users, roles, and organization-wide settings like Variables and Templates, is available to an Admin.

Unlike Super Admin, an organization can have multiple Admins.

## Contributor

Contributors are scoped to the specific groups (portfolios, products, or initiatives) they're invited to. Within those groups, they can create, edit, and manage data.

This access is **hierarchical**: inviting a Contributor to a portfolio gives them edit access to every product and initiative underneath that portfolio, not just the portfolio itself. Contributors do not have edit access to groups they haven't been invited to, or to sibling groups outside their invited scope.

## Viewer

Viewers have the same scoping model as Contributors, but read-only. A Viewer invited to a group can see that group and everything below it, without the ability to make changes.

Like Contributor access, Viewer access is **hierarchical**: view rights granted at a group cascade down to every group nested beneath it.

## A note on hierarchical scope

Because Contributor and Viewer access cascades downward, invite people at the highest level they need. For example, inviting a Contributor to a portfolio automatically covers every product and initiative in that portfolio, so there's no need to invite them separately to each one. Conversely, if someone should only work on a single product, invite them at that product level rather than the portfolio above it.