> ## Documentation Index > Fetch the complete documentation index at: https://docs.orriven.com/llms.txt > Use this file to discover all available pages before exploring further. # Roles > The five built-in roles and what each may do, area by area — assigned on Members, narrowed per Business Unit. orriven has five roles, defined by the platform. **Roles** in the organization section of the console is a read-only reference: one row per area of the product, one column per role, each cell listing what that role may do there. Roles are assigned on the organization's **Members** page and narrowed for one person inside a Business Unit on that unit's own Members page — see [Members & roles](/en/organization/members-roles). They are never edited. ## The roles | Role | Meant for | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | **Owner** | The account owner. Everything an Admin can do, plus deleting the organization. | | **Admin** | Runs the organization: Business Units, members, invitations, and every governance area — audit log, finance, API keys, webhooks, data & privacy. | | **Planner** | Builds and runs events. Full control of a Business Unit's content; can update the unit's settings. | | **On-site staff** | Day-of-event work. Reads everything in the unit and updates content — check-in, attendee lookups — but creates and deletes nothing. | | **Viewer** | Read-only. Sees the unit and its content, changes nothing. | ## What each role may do | Area | Owner | Admin | Planner | On-site staff | Viewer | | -------------------------- | -------------------------------- | -------------------------------- | ------------------------------- | ------------- | ------ | | **Organization** | Update · Delete | Update | — | — | — | | **Members** | Create · Update · Delete | Create · Update · Delete | — | — | — | | **Invitations** | Create · Cancel | Create · Cancel | — | — | — | | **Teams (business units)** | Create · Update · Delete | Create · Update · Delete | — | — | — | | **Business unit settings** | Create · Read · Update · Archive | Create · Read · Update · Archive | Read · Update | Read | Read | | **Business unit content** | Create · Read · Update · Delete | Create · Read · Update · Delete | Create · Read · Update · Delete | Read · Update | Read | | **Audit log** | Read | Read | — | — | — | | **Finance** | Refund | Refund | — | — | — | | **API keys** | Manage | Manage | — | — | — | | **Webhooks** | Manage | Manage | — | — | — | | **Data & privacy** | Export · Erase | Export · Erase | — | — | — | What the areas cover: * **Business unit content** — everything inside a unit's events: ticket types, add-ons, bundles, offers, forms, perks, attendees and registrations, agenda, speakers, venues, emails, cohorts, automations, exhibition, housing, check-in, surveys, reports. *Update* is what running the day needs — checking people in, editing an attendee — which is why On-site staff hold it without *Create* or *Delete*. * **Business unit settings** — the unit's name, description, timezone, currency, and access mode, and connecting its [payments](/en/organization/payments). * **Teams (business units)** — creating, renaming, and removing Business Units themselves. * **Audit log** — the organization-wide trail. The event-level and unit-level views of the same trail come with reading content. * **Finance** — issuing refunds from an order's detail page. Moving money is never part of content editing. * **API keys** and **Webhooks** — a key delegates the whole Business Unit to a program; an endpoint sends its entire event stream to another server. Both sit with Finance. * **Data & privacy** — data-subject export and erasure. See [Data & privacy](/en/organization/privacy). ## Rules to know * **Roles are fixed.** There is no custom role and no per-role editing. The console assigns roles; it does not define them. * **Owner and Admin differ in one thing:** only an Owner can delete the organization. * **Governance is Owner/Admin only** — audit log, finance, API keys, webhooks, data & privacy. Widening a Planner's reach into any of these is not possible. * **Organization Owners and Admins always resolve with full access inside every Business Unit.** A restricted unit drops the organization-role fallback for everyone else. * **Everyone who arrives through a shared credential starts as Viewer** — [single sign-on](/en/organization/sso) and the [organization ID](/en/organization/general) alike. A credential proves which company someone belongs to, not how much authority they hold. ## Related Assigning a role, and overriding it inside one Business Unit. Access modes, and what restricted mode changes.