Roles and permissions

Shield Control uses four roles, designed so security work, audit work, and administration can be separated cleanly.

The four roles

• Admin — everything: organization settings, billing, users, policies, audit.
• Security — writes policies and works Discovery and the audit log, without touching org administration.
• Auditor — read access plus exports. Made for compliance reviews: sees everything, changes nothing.
• Member — self-service only: their own profile and consent settings.

A role is assigned when you invite someone; people who join automatically via your verified domain start as Member, and whoever created the organization is its first Admin.

Changing a role

1. Open Users & Roles.
2. In the member's row menu, select Edit role.
3. Pick the new role and save.

The row menu is also where Remove member lives.

Note: the number of admin seats is plan-dependent (Starter 1, Business 5, Enterprise unlimited). If a role change would exceed the limit, Shield tells you instead of failing silently.