# Roles

Roles are named bundles of permissions you assign to users and user groups — Editors, Authors, Clients, whatever fits your team.

:::tip
Need the list of built-in abilities? That's [Permissions](/permissions.md). Registering your own in PHP? See [Custom Permissions](/control-panel/custom-permissions.md).
:::

## Overview

A [user](/users.md) has no Control Panel abilities on their own. You grant access by assigning **roles**, and each role is a named set of [permissions](/permissions.md).

Think of it as a stack:

1. **Permissions** — individual abilities (`edit blog entries`, `access cp`, …)
2. **Roles** — packages of those abilities ("Editor", "Publisher")
3. **Users / [groups](/user-groups.md)** — who gets which roles

Roles are managed in the Control Panel under **Users → Roles**, and stored in `resources/users/roles.yaml`.

## Creating roles

Create and edit roles in the Control Panel, or by hand in YAML:

```yaml
# resources/users/roles.yaml
editor:
  title: Editor
  permissions:
    - access cp
    - view blog entries
    - edit blog entries
    - create blog entries
    - publish blog entries
```

Pick permissions from the [native list](/permissions.md#native-permissions), or from [custom ones](/control-panel/custom-permissions.md) you've registered.

## Assigning roles

Attach roles to individual [users](/users.md), or to a [user group](/user-groups.md) so every member inherits them.

On a user YAML file:

```yaml
roles:
  - editor
  - publisher
```

In the Control Panel: open the user (or group) and pick roles from the list. Prefer groups when you have more than a handful of people with the same access — assign the role once on the group instead of per user.

### In blueprints

Need a field that picks roles? Use the [User Roles](/fieldtypes/user-roles.md) fieldtype.

### On the frontend

Check the current user's roles with [`{{ user:is }}`](/tags/user-is.md), or list roles with [`{{ user:roles }}`](/tags/user-roles.md).

## Super users

[Super users](/users.md#super-users) bypass roles and permissions entirely. They can do everything — including create more super users. Keep that circle small.