--- title: Using user roles and permissions summary: null url: >- https://www.fastly.com/documentation/guides/next-gen-waf/account-info/using-user-roles-and-permissions --- > **IMPORTANT:** This guide only applies to Next-Gen WAF customers with access to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net). If you have access to the Next-Gen WAF product in the [Fastly control panel](https://manage.fastly.com), check out our guide to [managing users](https://www.fastly.com/documentation/guides/account-info/user-and-account-management/about-user-roles-and-permissions) of Fastly accounts. Every user in your account (also known as corp) is [assigned a role](https://www.fastly.com/documentation/guides/next-gen-waf/account-info/managing-users/). Roles are groups of permissions that afford users the ability to view and control a variety of things in your account (corp). - **Owners** have access to all account (corp) features, can edit settings on every workspace (also known as site), and can make changes to user accounts. - **Admins** have limited access to account (corp) features, access to specific workspaces (sites) and site-level (workspace-level) settings, and can invite new users to specific workspaces (sites). - **Users** have access to specific workspaces (sites) and site-level (workspace-level) settings. - **Observers** have access to specific workspaces (sites). ## Account (corp) management permission The account (corp) management permissions for each role are as follows: | Permission | Owner | Admin | User | Observer | | ----------------------------------------------- | ------ | -------------- | -------------- | -------------- | | View account-wide (corp-wide) data and reports | Access | Limited access | Limited access | Limited access | | Edit account-wide (corp-wide) security policies | Access | No access | No access | No access | | Create or edit account (corp) rules | Access | No access | No access | No access | | View account (corp) rules | Access | Access | Access | Access | | Create or edit account (corp) lists | Access | No access | No access | No access | | Create or edit account (corp) signals | Access | No access | No access | No access | | View account (corp) integrations | Access | Access | Access | Access | | Edit account (corp) integrations | Access | No access | No access | No access | | View account (corp) audit logs | Access | Access | Access | Access | ## User management permissions The user management permissions for each role are as follows: | Permission | Owner | Admin | User | Observer | | --------------------------------------- | ---------------------- | --------------------------- | --------------------------- | --------------------------- | | View users | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Invite or remove other users | All workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | No workspaces (sites) | | Allow users to create API Access Tokens | Access | No access | No access | No access | ## Workspace (site) management permissions The workspace (site) management permissions for each role are as follows: | Permission | Owner | Admin | User | Observer | | ---------------------------------------------------- | ---------------------- | --------------------------- | --------------------------- | --------------------------- | | Create or delete workspaces (sites) | Access | No access | No access | No access | | View site-level (workspace-level) data and reports | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Edit workspace (site) blocking mode | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | Edit workspace (site) IP anonymization policy | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | Edit workspace (site) default blocking response code | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View associated users | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | Edit workspace (site) Display Name and Short Name | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | ## Workspace (site) configuration permissions The workspace (site) configuration permissions for each role are as follows: | Permission | Owner | Admin | User | Observer | | -------------------------------- | ---------------------- | --------------------------- | --------------------------- | --------------------------- | | Change Blocking Mode | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | Create or edit rules | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View rules | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Create or edit signals | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View signals | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Create or edit lists | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View lists | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Create or edit redactions | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View redactions | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Create or edit integrations | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View integrations | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | | Create agent keys | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View agent keys | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | | View workspace (site) audit logs | Access | Access | Access | Access | ## Personal account management permissions The personal account management permissions for each role are as follows: | Permission | Owner | Admin | User | Observer | | ---------------------------------- | -------------- | -------------- | -------------- | -------------- | | Edit account profile information | Access | Access | Access | Access | | Create, edit, view support tickets | Access | Access | Access | Access | | Create API Access Token | Limited access | Limited access | Limited access | Limited access | ## Related content - [Corp users API documentation](https://www.fastly.com/documentation/signalsciences/api/#_corps__corpName__users_get)