# Managing roles from the console

The console manages roles, assignments, scopes and individual exceptions through four sections.

| Section | What it lets you do | Required permissions |
|---|---|---|
| **Role catalogue** | View, create, edit and delete role definitions — their name and the permissions they include | `roles:read` / `roles:write` |
| **Assignments** | Assign and unassign roles to employees, activate and deactivate them | `employees:read` / `employees:write` |
| **Scope** | Configure what data each employee can access — brands, stores, sources | `employees:read` / `employees:write` |
| **Exceptions** | Create individual grants or denies on a specific permission for an employee, with an optional expiry date | `employees:read` / `employees:write` |

## Who can reach each section

**Role catalogue** is restricted to `super_admin` — PizzaGest's own technical role. Creating or changing a role definition goes through the development team, who review the change before applying it. See [Requesting a new or changed role](/books/console-yF7/page/requesting-a-new-or-changed-role).

**Assignments, Scope and Exceptions** are available to `admin` and `employee_manager`. These are the three you will use day to day: assigning existing roles, setting scope, and managing exceptions.

> This split is deliberate. Changing what a role *means* affects every employee holding it, across the whole chain — so it is reviewed. Changing who *holds* a role affects one person, and is yours to do directly.

## Assigning a role to an employee

1. Open **Assignments**.
2. Find the employee.
3. Add the role or roles they need — see [The role catalogue](/books/console-yF7/page/the-role-catalogue) and [Common role combinations](/books/console-yF7/page/common-role-combinations).
4. Confirm their scope separately, under **Scope**. A new role does not change existing scope.

An assignment can be deactivated rather than removed, which keeps the record while suspending the access.

> Assigning a role does not give someone a way to sign in. Setting or resetting their password is a separate task, done from the Employees screen — see [Employees - Password](/books/console-yF7/page/employees-password).

## Safeguards

These protect you from the changes that are hardest to undo:

- A role with active assignments **cannot be deleted**.
- Permissions attached to a role are validated against the system permission catalogue, so a typo can't create a permission that does nothing.
- Every assignment and every exception records **who created it**, for auditing.
- Individual denies always override what a role grants.

## Related pages

- [Setting an employee's scope](/books/console-yF7/page/setting-an-employees-scope) — the three dimensions in practice
- [Individual permission exceptions](/books/console-yF7/page/individual-permission-exceptions) — grants and denies
- [Requesting a new or changed role](/books/console-yF7/page/requesting-a-new-or-changed-role) — when no combination fits