# Roles and permissions

URL: /security/roles

Foxborne has five fixed roles, from admin to auditor. Each carries a fixed set of permissions, so an audit can reason about who could import, edit, approve, export or read the audit log.



Each person in Foxborne holds one of five roles: admin, investigator, reviewer, viewer or auditor. The permissions of each role are fixed, so an audit can reason about them.

## The five roles [#the-five-roles]

| Role         | What it does                                                          | SCIM group               |
| ------------ | --------------------------------------------------------------------- | ------------------------ |
| Admin        | Runs the deployment: sources, hosting, access, retention and rules.   | `foxborne-admins`        |
| Investigator | Imports runs, opens incidents, annotates evidence and writes reports. | `foxborne-investigators` |
| Reviewer     | Reads everything an investigator can, comments and approves reports.  | `foxborne-reviewers`     |
| Viewer       | Reads approved reports and their evidence. Cannot import or edit.     | `foxborne-viewers`       |
| Auditor      | Reads the audit log, exports and the evidence chain. Cannot edit.     | `foxborne-auditors`      |

The descriptions are the ones on the **Roles** tab under **Access**. Its **Roles** table gives each role's name, **What it is for** and the number of **People** who hold it.

## Permissions [#permissions]

The **Permissions** panel on the same tab carries the subtitle **Fixed per role, so an audit can reason about them.** A blank cell means the role does not hold the permission.

| Permission                          | Admin | Investigator | Reviewer | Viewer | Auditor |
| ----------------------------------- | ----- | ------------ | -------- | ------ | ------- |
| Import runs and files               | Yes   | Yes          |          |        |         |
| Open and edit incidents             | Yes   | Yes          |          |        |         |
| Inspect original evidence           | Yes   | Yes          | Yes      | Yes    | Yes     |
| Comment on reports                  | Yes   | Yes          | Yes      |        |         |
| Approve reports                     | Yes   |              | Yes      |        |         |
| Export case files                   | Yes   | Yes          | Yes      |        | Yes     |
| Read and download reports           | Yes   | Yes          | Yes      | Yes    | Yes     |
| Save, schedule and generate reports | Yes   | Yes          | Yes      |        |         |
| Manage sources and collectors       | Yes   |              |          |        |         |
| Change detection rules              | Yes   |              |          |        |         |
| Save a parser for a new log format  | Yes   |              |          |        |         |
| Read the audit log                  | Yes   |              |          |        | Yes     |
| Manage hosting, keys and access     | Yes   |              |          |        |         |

## Who approves reports [#who-approves-reports]

* Admins and reviewers hold **Approve reports**. Investigators write reports but cannot approve them.
* A request for review is recorded in the audit log as **Requested review**, with the reviewer's name.
* On the incident's **Report** tab, **Approve report** appears in the **Report** panel while the report is **In review**, for the reviewer named on that incident.
* The report's status chip reads **Draft**, **In review** or **Approved**. Viewers read approved reports and their evidence.

## Who reads the audit log [#who-reads-the-audit-log]

* Admins and auditors hold **Read the audit log**. The **Audit log** page gives them **Verify chain** and **Export** as well.
* An auditor reads the audit log, exports and the evidence chain, and cannot edit.
* Auditors also hold **Inspect original evidence** and **Export case files**, so they can check a report against its sources.

## Evidence marked EXPT [#evidence-marked-expt]

All five roles hold **Inspect original evidence**. Evidence marked EXPT also needs US person status: it opens only for users whose identity provider asserts it. See [Export-controlled evidence](/security/export-control).

## Where roles are set [#where-roles-are-set]

| Where              | How                                                                          |
| ------------------ | ---------------------------------------------------------------------------- |
| **Invite someone** | Choose the **Role** when you invite. The list starts at **Investigator**.    |
| **Change role**    | From the person's row on **Members**. It takes effect on their next request. |
| SCIM               | Membership of the matching Foxborne group in your identity provider.         |

**Change role** writes **Changed role** to the audit log, with the person and the new role. An invitation writes **Invited user**, with the role as its detail.

## Related [#related]

* [Invite, change and remove access](/security/manage-access) walks through inviting, changing a role and removing access.
* [SCIM provisioning](/security/scim) maps the five groups in your identity provider to these roles.
* [Write and review a report](/investigate/write-a-report) shows the review and approval steps.
* [Audit log](/security/audit-log) lists every action and who records it.