Roles

A role is a named collection of permissions assigned to one or more users. Instead of granting permissions individually, you bundle them into a role and assign that role to users. A user’s access is the combined set of all permissions across every role they hold.

Manage roles from Control Hub → Access Control → Roles.

There are two types of roles: system roles and custom roles.

System roles

System roles are predefined by grengin. They cannot be deleted and their permissions cannot be modified — they represent standard access patterns for common organizational responsibilities. System roles are labeled (System) in the UI.

What you can do	What you cannot do
Add or remove users (with Roles: Assign)	Add or remove permissions from the role
Update department scope per user via Manage scoping	Delete the role or rename system roles
View permissions included in the role	Edit permissions on system roles

Grengin ships with seven system roles:

Role	Purpose
Super Admin	Full access to every part of the platform
IT Admin	Manage AI infrastructure, MCP servers, SSO, and system maintenance
Finance Admin	Manage budgets and view financial analytics
HR Admin	Manage users, departments, and role assignments
Department Admin	Manage a department’s people, budget, and MCP server access
Observer	Read-only visibility into users, departments, and analytics
User	No Control Hub access — standard grengin chat user

Super Admin is protected in the UI — it cannot be edited or deleted.

Super Admin

Full platform access. Super Admins can configure every part of grengin, manage all users and roles, and perform system-level operations. Assign this role sparingly.

Domain	Action	Scope
AI Platform	Manage	Global
AI Platform	View	Global
Analytics	View	Department
Audit Logs	View	Global
Budget	View	Department
Budget	Allocate	Department
Departments	View	Department
Departments	Manage	Department
MCP Servers	View	Global
MCP Servers	Admin	Global
MCP Servers	Delegate	Department
Roles	View	Global
Roles	Manage	Global
Roles	Assign	Department
SSO Providers	View	Global
SSO Providers	Manage	Global
System	Maintain	Global
Users	View	Department
Users	Manage	Department

IT Admin

Covers grengin’s technical infrastructure — AI engines, MCP servers, SSO integrations, and system maintenance. IT Admins have no access to user management, budgets, or org structure.

Domain	Action	Scope
AI Platform	Manage	Global
MCP Servers	View	Global
MCP Servers	Admin	Global
MCP Servers	Delegate	Department
SSO Providers	View	Global
SSO Providers	Manage	Global
System	Maintain	Global

Finance Admin

Scoped to financial operations. Finance Admins can view and allocate budgets, monitor analytics, and view department structure — but cannot manage users, roles, or platform configuration.

Domain	Action	Scope
Analytics	View	Department
Budget	View	Department
Budget	Allocate	Department
Departments	View	Department

HR Admin

Focused on people and org management. HR Admins can manage users and departments, view roles, and assign roles to users — but have no access to budgets, analytics, or platform configuration.

Domain	Action	Scope
Departments	View	Department
Roles	View	Global
Roles	Assign	Department
Users	View	Department
Users	Manage	Department

Department Admin

Designed for managers who own a specific department. Department Admins can manage their department’s members, budgets, and MCP server delegation. When assigning this role, restrict department-scoped permissions to the relevant departments via Manage scoping.

Domain	Action	Scope
Analytics	View	Department
Budget	View	Department
Budget	Allocate	Department
Departments	View	Department
Departments	Manage	Department
MCP Servers	Delegate	Department
Users	View	Department
Users	Manage	Department

Observer

Read-only access to users, departments, and analytics. Observers can see what is happening but cannot take actions or modify anything.

Domain	Action	Scope
Analytics	View	Department
Departments	View	Department
Users	View	Department

User

No permissions. This is the default role for standard grengin chat users who do not need Control Hub access. Users with only this role will not see the Control Hub link and cannot access it.

Custom roles

Custom roles let you define access patterns beyond the system roles. Create as many as needed and change them at any time.

What you can do
Create a role with any name
Add or remove any permissions
Add or remove users (with Roles: Assign)
Update department scope per user via Manage scoping
Edit or delete the role (with Roles: Manage)

Create a custom role

Go to Control Hub → Access Control → Roles.
Click Add new role (requires Roles: Manage).
Enter a role name.
Select permissions from the grouped checklist. Use Select all or Clear within each domain as needed.
Click Create role.

Assign users and configure scope

On the role card, click Add user (requires Roles: Assign).
Search for and select the user.
For department-scoped permissions, expand Users with this role, then click Manage scoping next to the user.
Assign specific departments, or choose Assign all departments for unrestricted access within that role’s department-scoped permissions.

Edit or remove a custom role

Edit role — change the name or permission set (requires Roles: Manage).
Delete role — permanently removes the role; users lose its permissions (requires Roles: Manage).

Access Control overview — how roles and permissions shape the Control Hub experience.
Permissions — full permission reference when building custom roles.