> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.granitegrc.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How can I create new roles?

|| You can create roles through **System Admin view only** if you have permission to manage roles.

**Creating a role that grants basic view access (including the ability to create new forms in a tool):**
* Navigate to **System Admin → Roles → Add New Role**.
* Enter a clear name and description for the role.
* Under **Basic View Permissions**, click **Add Permission**.
* Configure the permission: Select the **module** (tool) to which the role applies. In **Organization / Asset**, select the asset for which you want to grant access. In **Instance**, select either:
  * A specific instance, or
  * **All Existing Instances.** 
This determines whether the role grants access to only one Instance or to all current and future Instances under the selected asset.
* Save the role. You can now assign it to users through the **Roles tab** in **Admin view**.

**Creating a role that grants access to assessment-type tool forms (for example, in the Information Security Incidents tool):**
* Navigate to **System Admin → Roles → Add New Role**.
* Enter a clear name and description for the role.
* Under **Permissions**, click **Add Permission**.
* Configure the permission: In **Action**, select **"Assessment: Read and Edit Access to Forms (Asset)"**. Select the asset to which the role should apply. In **Restrictions**, select the module (tool) if you want to limit the role to a specific assessment-type tool and prevent access to forms in other assessment tools.
* Save the role. You can now assign it to users through the **Roles** tab in **Admin view**.

**Creating a role that grants access to reporting-type tool forms (for example, in the ERM Enterprise Risk Management tool):**
* Navigate to **System Admin → Roles → Add New Role.**
* Enter a clear name and description for the role.
* Under **Permissions**, click **Add Permission**.
* Configure the permission: In **Action**, select **"Report: Read and Edit Access to Forms (Asset)"**. Select the asset to which the role should apply. In **Restriction**, select the module (tool) if you want to limit the role to a specific reporting-type tool and prevent access to forms in other reporting tools.
* Save the role. You can now assign it to users through the **Roles** tab in **Admin view**.

**Additional notes and limitations**
* Some roles cannot be edited or deleted, such as certain default system roles or training-related roles.
* If role visibility or permission inheritance does not work as expected, verify the role’s asset scope, organizational restrictions (parent vs. child level) and any module-specific settings that may affect permissions.

**Best practices**
* Use consistent naming conventions for roles, for example: **ERM – Finance Department – Read** and **ERM – Finance Department – Edit**
* Test role changes with a limited group of users before rolling them out to a larger audience.