# Role-Based Access Control (RBAC)

Escape's Role-Based Access Control (RBAC) uses **Projects** to group resources and manage access. Projects are flat groups of resources. A resource can belong to several projects.

Roles define permissions, and role bindings apply them globally or to a specific project.

## Built-In Roles

When you create an organization, Escape seeds two roles. You can create additional roles from the permissions below. See [Roles management](<https://docs.escape.tech/documentation/enterprise/rbac/roles-managment/index.md>).

| Role | Description |
| --- | --- |
| **Admin** | Includes the Admin permission. Supersedes all other permissions on the scope where the role is bound. |
| **Viewer** | Includes the Viewer permission. Read-only access to pages and resources. |

A project-scoped Admin can manage resources in that project. Managing organization-wide users, roles, or settings requires a global Admin binding. See [Access control](<https://docs.escape.tech/documentation/enterprise/rbac/access-control/index.md>).

## Built-In Permissions

A role is a collection of permissions. Role bindings grant those permissions globally or on a specific project.

| Permission | Description |
| --- | --- |
| **Admin** | Supersedes all other permissions on the bound scope. |
| **Viewer** | Read-only access to all pages and resources. |
| **Edit Assets** | Create, edit, and delete assets. |
| **Edit Profiles** | Create and edit profiles, and run scans. See [Per-Feature Details](<https://docs.escape.tech/documentation/enterprise/rbac/per-feature-details/index.md>) for bulk updates and deletion. |
| **Edit Custom Rules** | Create, edit, and delete custom rules. |
| **Edit Workflows** | Create, edit, and delete workflows. |
| **Edit Integrations** | Create, edit, and delete integrations. |
| **Tag Edition** | Create, edit, and delete tags. |
| **Manage Reporting** | Manage reporting settings. |