> ## Documentation Index
> Fetch the complete documentation index at: https://docs.saasfoundation.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> Understand access control in the admin and customer portals.

SaaS Foundation has separate role and permission systems for the admin and
customer portals. A platform role controls access across the application. An
organization role controls access within one organization.

The two systems intentionally remain separate. An organization administrator
does not automatically receive access to the admin portal.

## Admin portal

The admin portal uses the nullable `role` field stored on the `User` model. A
user only has access to the admin portal when this field is set. When the field
is `null`, the admin route wrapper returns `403 Forbidden`.

### Roles

#### Admin

Platform administrators manage users and sessions across the platform. They can
also manage API keys, organizations, members, and invitations.

#### User

Regular users have none of the admin permissions listed below. They access and
read organization data through their memberships in the customer portal.

### Permissions

Users with the `admin` role have the following permissions:

* **User:** `create`, `list`, `set-role`, `ban`, `impersonate`, `delete`, `set-password`, `set-email`, `get`, `update`
* **Session:** `list`, `revoke`, `delete`
* **API key:** `read:any`, `delete:any`
* **Organization:** `create`, `update`, `delete`
* **Member:** `create`, `update`, `delete`
* **Invitation:** `create`, `cancel`

The user and session permissions come from Better Auth's admin plugin. SaaS
Foundation adds permissions for the other resources used by the admin portal.

## Customer portal

The customer portal uses the `role` field stored on each `Member` record. A
membership connects one user to one organization, so the same user can be an
owner in one organization, an admin in another, and a member in another.

### Roles

#### Owner

Organization owners have full control over the organization, its members,
invitations, teams, and access control.

#### Admin

Organization administrators manage the organization and its people, but cannot
delete the organization.

#### Member

Organization members have read access to all items in their organization.

### Permissions

#### Owner

* **Organization:** `update`, `delete`
* **Member:** `create`, `update`, `delete`
* **Invitation:** `create`, `cancel`
* **Team:** `create`, `update`, `delete`
* **Access control:** `create`, `read`, `update`, `delete`

#### Admin

An Admin has the same permissions as an Owner, except they cannot delete an
organization.

#### Member

Members have read access to all items.