> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getray.info/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> How access works in the RAY admin portal: every portal user has one or more roles; a role has a type (Admin, Operator or Security), a location (Global or one specific location) and a set of features; together they decide which menus and screens the user sees.

## Summary

Access to the RAY admin portal is controlled by **roles**. A role has a **Type** (Admin, Operator or
Security), a **Location** (Global, or one specific location) and a list of **Features**. A user can
hold several roles. A menu entry is shown only when one of the user's roles has the right type and
includes the right feature. Roles are created and assigned under **Administration → Roles &
Permissions**.

## Role types in the RAY admin portal

| Role type    | Arabic label      | What the role type shows                                                                                                                                                                                                     |
| ------------ | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Admin**    | المشرف على الموقع | Management and setup screens for its features: properties, booking setup, community content, directory, administration, payment setup, documents. Also the portal **Home** page.                                             |
| **Operator** | مشغّل             | Day-to-day record screens for its features: Booking Records, Lease Management, Suggestion Box, Visit Records, Access Logs, Billable Items, Invoices, Subscriptions, Delivery Operator, service forms, lists and shop orders. |
| **Security** | الأمن             | The Security menu only: Visit Security, Tenant Security, Booking Security, Subscription Security.                                                                                                                            |

The exact screens per role type and feature are listed in the [Portal map](/getting-started/portal-map).

Users who only use the RAY mobile app have no portal role. When they sign in to the portal they see
"Looks like you don't have any features enabled yet. Reach out to your administrator to get
started."

## Features and access in the RAY admin portal

A **feature** is a product module, such as bookings, visitor management or invoices. A role grants
the features ticked in its **Features** tab. The same feature opens different screens depending on
the role type. For example, the bookings feature:

* on an Admin role shows **Booking Records**, **Spaces** and **Booking Setup**;
* on an Operator role shows **Booking Records** only;
* on a Security role shows **Booking Security**.

Service forms, lists and shops each have their own feature, so a role can give access to one form or
one shop without giving access to the others.

The feature names shown in the **Features** tab depend on the organization's setup, and some can be
renamed in [Features & Audiences](/administration/features-and-audiences). This documentation
describes features by what they cover, such as "the visitor management feature".

## Location of a role

Organizations with several sites (see [Multi Location Setup](/administration/multi-location-setup))
can limit a role to one location.

| Location option       | Arabic label | Effect                                                                     |
| --------------------- | ------------ | -------------------------------------------------------------------------- |
| **Global**            | عالمي        | The role applies to every location.                                        |
| **Specific Location** | موقع محدد    | The role applies only when that location is selected in the portal header. |

The location selector in the portal header decides which location the user is working in. The menus
then follow the user's Global roles plus their roles for the selected location, so screens can
appear or disappear when the location is changed.

## How to give a user access to a portal screen

1. Find the screen in the [Portal map](/getting-started/portal-map) and note the role type and
   feature it needs.
2. Open **Administration → Roles & Permissions**.
3. Either open an existing role of the right type and location from the **Roles** tab, or create a
   role: click **Add**, enter the **Role** name, choose the **Type** (**Admin**, **Security** or
   **Operator**) and the **Location** (**Global** or **Specific Location**), and click **Save**.
4. In the role's **Features** tab, tick the feature.
5. In the role's **Assignments** tab, click **Assign**, choose the user and click **Save**.

A role's **Type** and **Location** cannot be changed after the role is created. Full steps are in
[Roles & Permissions](/administration/roles-and-permissions).

## Common questions about portal access

### Why can't a user see a menu in the RAY admin portal?

A menu entry is hidden when none of the user's roles has both the required role type and the
required feature for the location selected in the portal header. Check the
[Portal map](/getting-started/portal-map) for what the screen needs, then check the user's roles in
**Administration → Roles & Permissions**. A menu group such as **Properties** is hidden when the
user can see none of the screens in it.

### Can one user have several roles?

Yes. A user can hold several roles, for example an Admin role for one location and an Operator role
for all locations. The user sees every screen that any of the applicable roles allows.

### What is the difference between Admin and Operator?

An Admin role opens setup and management screens for its features. An Operator role opens only the
day-to-day record screens for the same features. For example, with the invoices feature an Admin
sees **Billable Items**, **Invoices** and **Invoice Settings**, while an Operator sees **Billable
Items** and **Invoices** only.

### Why do I get the Forbidden page?

The **Forbidden** page appears when a link is opened to a screen that is not in the user's menu, or
when the selected location is one the user has no role for.

## Related pages

* [Portal map](/getting-started/portal-map): every screen with the role type and feature it needs.
* [Roles & Permissions](/administration/roles-and-permissions): the screen where roles are created and assigned.
* [Features & Audiences](/administration/features-and-audiences): activating features and choosing who is offered them.
* [Glossary](/getting-started/glossary): definitions of role, feature, location and other terms.