---
title: "Rocket Chat User Roles and Permissions"
slug: "roles-in-rocketchat"
description: "Explore user roles in Rocket Chat. Ensure secure communications and proper governance with defined permissions."
status: "update"
updated: 2026-11-04T19:54:25Z
published: 2026-11-04T19:54:25Z
canonical: "docs.rocket.chat/roles-in-rocketchat"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles in Rocket.Chat

Roles and permissions control what users can do in your workspace. Rocket.Chat uses a role-based system where each role represents a defined set of [permissions](https://docs.rocket.chat/docs/permissions), and administrators assign roles to users to grant the appropriate level of access.

- **Role**: A named set of permissions assigned to a user or group of users. Roles determine which features and controls a user can access. By default, roles appear as tags next to usernames on messages. To turn this on or off workspace-wide, go to **Accounts** → **Default User Preferences** → **Hide Roles**. Individual users can override this for their own account from [Accessibility & appearance](https://docs.rocket.chat/docs/accessibility-and-appearance) settings.
- **Permission**: A specific feature or setting that can be granted to a role. Different roles have different default permissions, which you can review and modify on the **Permissions** screen.

To view roles and permissions in your workspace, go to **Manage** → **Workspace** → **Permissions**. The screen shows a table where:

- Each **row** is a permission (the **Name** column lists permission names).
- Each **column** is a role.
- Each **checkbox** indicates whether the role in that column has the permission in that row.

Select or clear checkboxes to grant or revoke permissions for a role.

---

## Scope of Rocket.Chat roles

Roles in Rocket.Chat have either a **Global** or **Room** scope.

### Global scope

Global roles apply across the entire workspace, for example, `admin`. They can hold permissions that operate at the server level rather than within a specific room. For example, **Create a Team** is a global permission that lets a user create teams from anywhere in the workspace.

### Room scope

Room-scoped roles control access to room-specific permissions. For example, you can grant the **Edit Room** permission to the **Moderator** role and any user set as a moderator in a specific room can edit that room's information. Visit [Room Roles](/v1/docs/room-roles) to learn more about the available room roles.

You can assign these roles to a user in an individual room or globally across the workspace.

- **In a room:** Assign the role from the room's members list. Its permissions apply only to that room. See [Room Roles](/v1/docs/room-roles) for more details.
- **On the user account:** Add the role to the **Roles** field when creating or editing a user in **Manage** → **Workspace** → **Users**. Its permissions apply across all rooms, including those where the user has no room-specific role. Visit [Invite and Add Users](/v1/docs/invite-and-add-users) for more details.

---

## Categories of Rocket.Chat roles

Rocket.Chat provides three built-in categories of roles:

- Administrator role
- Workspace user roles
- Omnichannel roles

Let’s look at the roles for each category.

### Administrator role

A Rocket.Chat administrator has the `admin` role with **Global** scope, granting full access to the entire workspace. Admins can manage both [workspace administration](https://docs.rocket.chat/docs/workspace-administration) and [omnichannel](https://docs.rocket.chat/docs/omnichannel) settings. The first user who registers and logs into a new workspace is automatically assigned the `admin` role.

### Workspace user roles

Users can have one or more of the following roles, which together determine what actions they can perform.

| Role | Scope | Description |
| --- | --- | --- |
| `user` | **Global** | - This is the most common role in Rocket.Chat. It serves as a standard role for all workspace members. - Users can join rooms, send messages, upload files, and participate in all forms of communication. - By default, this role is assigned to new users who join the workspace. |
| `bot` | **Global** | - Automated users that can be programmed to perform specific tasks, such as sending messages, answering questions, and triggering notifications. - This role has some permissions related to bot functionality. |
| `guest` ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Premium(1).svg) | **Global** | - [Guest users](/v1/docs/guest-users) have limited access to your Rocket.Chat workspace. - They can only participate in rooms they are a member of. - The permissions for this role are not editable. |
| `app` | **Global** | - Automated users that are used by Rocket.Chat apps from the [Rocket.Chat Marketplace](/v1/docs/rocketchat-marketplace). - Depending on the app you install, the app bot can send you instructions on how to configure the app. - The app user can also be automatically available on the [Users](/v1/docs/invite-and-add-users) screen. |
| `Moderator` | **Room** | Moderators can manage messages, delete messages, and ban users from a specific channel. See [Moderation](/v1/docs/moderation) for details on how to use this feature. |
| `Leader` | **Room** | You can assign your preferred set of [permissions](/v1/docs/permissions) to the room leader for managing the room. |
| `Owner` | **Room** | - Users who create a room become its owners. - The room owner can manage the channel, including controlling access to joining the channel, editing channel settings, and managing messages within the channel. - Room owners can set other room members as owners, leaders, and moderators. |
| `auditor` ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Premium(1).svg) | **Global** | It allows a user to view and [audit all messages](/v1/docs/audit-logs) within the workspace. Users with only the `auditor` role cannot send messages. |
| `auditor-log` ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Premium(1).svg) | **Global** | The `auditor-log` role allows a user to see [logs about all audited messages](/v1/docs/audit-logs) with timestamps and by whom. Users with only the `auditor-log` role cannot send messages. |
| `External Federated User` | **Global** | - A dedicated role assigned to remote users connecting to your workspace through [Federation](/v1/docs/decentralized-communication-with-federation-in-rocketchat). - Previously, remote federated users were granted the `user` role, which coupled different user personas under the same set of permissions. - The dedicated role separates federated users from local users so permissions can be tuned independently for each persona. |

> [!CAUTION]
> The `anonymous` role is removed in Rocket.Chat 9.0.0. Users who still have the `anonymous` role when you update are deactivated and logged out. When **Allow anonymous read** is enabled in the [Accounts](/v1/docs/accounts) settings, people can still read messages in public channels without signing in.

### Omnichannel roles

[Omnichannel](/v1/docs/omnichannel-users) roles let users interact with or manage Omnichannel features.

| Role | **Scope** | Description |
| --- | --- | --- |
| `Livechat Agent` | **Global** | Handles inquiries and support requests through [Omnichannel](https://docs.rocket.chat/docs/livechat-widget-installation). |
| `Livechat Manager` | **Global** | Manages agents and all other Omnichannel features. |
| `livechat-monitor` | **Global** | Views and [monitors](https://docs.rocket.chat/docs/monitors) Livechat interactions and analytics. |

> [!WARNING]
> **The administrator role, user roles, and Omnichannel roles are available by default in every Rocket.Chat workspace. To create roles tailored to your needs, see** [**Custom Roles**](https://docs.rocket.chat/docs/custom-roles)**.**

---

## Edit roles

![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Premium(1).svg)

To edit a role:

1. Go to **Manage → Workspace → Permissions**.
2. Click the pencil icon next to the role name in the column header. The **Role Editing** panel opens.
3. Update the available fields, then click **Save**.

The following fields are shown in the **Role Editing** panel:

| Field | Editable for default roles | Editable for custom roles | Description |
| --- | --- | --- | --- |
| **Role** | No | No | The role's internal identifier (for example, `admin`). To change a role's name, use the [update role endpoint](https://developer.rocket.chat/reference/api/rest-api/endpoints/user-management/roles-endpoints/update-role). |
| **Description** | Yes | Yes | The label shown to users (for example, `Admin`). Leave this field blank if you do not want the role to be displayed. |
| **Scope** | No | Yes | Determines whether the role applies workspace-wide (**Global**) or only inside specific rooms (**Rooms**). Editable only for custom roles. |
| **Users must use Two Factor Authentication** | Yes | Yes | When enabled, users with this role must use 2FA for certain workspace actions, such as logging in or changing settings. Make sure [2FA](https://docs.rocket.chat/docs/two-factor-authentication-configuration) is configured in your workspace. |

> [!WARNING]
> Custom roles can also be deleted from this panel. Default roles cannot be deleted.

---

## View and assign users to roles

To see which users are assigned to a role, click **Users in role** at the bottom of the **Role Editing** panel. From this view you can also add users to the role or remove them.

The following screenshot shows an example of the `user` role:

![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/role-1.png)

For room-scope roles, you must first select a room. The list then shows users who hold that role in the selected room. Users who hold the role on their account, rather than in that room, are not listed. The user must already be a member of the room before you can assign them a room-scope role.

The following screenshot shows the `Moderator` role in a room called **random**:

![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/role-2.png)

In this example, search for the user and click **Add** to give other users the **Moderator** role in the **random** room. The user must belong to the selected room before you can assign a role to them.

> [!NOTE]
> - **For information on creating custom roles, see** [**Custom Roles**](https://docs.rocket.chat/docs/custom-roles)**.**
> - **For information on permissions and settings, see** [**Permissions**](https://docs.rocket.chat/docs/permissions)**.**
> - **Roles and permissions can also be managed via the REST API. See** [**Roles API**](https://developer.rocket.chat/apidocs/roles-api) **and** [**Permissions API**](https://developer.rocket.chat/apidocs/permissions-api) **for details.**